Arrest of Canadian man suspected of running the KimWolf botnet

Dismantled in March 2026, it had been used in numerous large-scale DDoS attacks.

Canadian police arrested, on May 20, 2026 in Ottawa, Jacob Butler, a 23-year-old Canadian citizen suspected of having administered the KimWolf botnet, which was used in numerous large-scale DDoS attacks. Charged with complicity in unauthorized computer access, he faces up to ten years in prison.

According to court documents made public on May 21, 2026, Jacob Butler was operating this botnet of approximately one million devices as an on-demand DDoS service. In March 2026, a major international operation led by American, Canadian, and German authorities resulted in the dismantling of KimWolf.

“This botnet has been associated with DDoS attacks reaching peak traffic of nearly 30 terabits per second, a record level recorded to date. These attacks caused financial losses that, for some victims, exceeded one million dollars. The KimWolf botnet is alleged to have executed more than 25,000 attack commands,” prosecutors stated.