Dismantled in March 2026, it had been used in numerous large-scale DDoS attacks.

Canadian police arrested, on May 20, 2026 in Ottawa, Jacob Butler, a 23-year-old Canadian citizen suspected of having administered the KimWolf botnet, which was used in numerous large-scale DDoS attacks. Charged with complicity in unauthorized computer access, he faces up to ten years in prison.

According to court documents made public on May 21, 2026, Jacob Butler was operating this botnet of approximately one million devices as an on-demand DDoS service. In March 2026, a major international operation led by American, Canadian, and German authorities resulted in the dismantling of KimWolf.

“This botnet has been associated with DDoS attacks reaching peak traffic of nearly 30 terabits per second, a record level recorded to date. These attacks caused financial losses that, for some victims, exceeded one million dollars. The KimWolf botnet is alleged to have executed more than 25,000 attack commands,” prosecutors stated.

Stay tuned in real time
Subscribe to
the newsletter
By providing your email address you agree to receive the Incyber newsletter and you have read our privacy policy. You can unsubscribe at any time by clicking on the unsubscribe link in all our emails.
Stay tuned in real time
Subscribe to
the newsletter
By providing your email address you agree to receive the Incyber newsletter and you have read our privacy policy. You can unsubscribe at any time by clicking on the unsubscribe link in all our emails.