A criminal complaint has been unsealed charging a Canadian man with operating the KimWolf Distributed Denial of Service Internet of Things botnet.

The U.S. complaint was unsealed following the defendant’s arrest in Canada by Canadian authorities. Mr Butler is charged with one count of aiding and abetting computer intrusion. If convicted, Butler faces up to 10 years in prison.

According to court documents, on April 10, 2026, U.S. authorities criminally charged Jacob Butler, aka ‘Dort’, 23, of Ottawa, Canada, with offences related to the development and operation of the KimWolf botnet.

KimWolf was a DDoS-for-hire service which infected over a million devices worldwide, including devices located in Alaska. The complaint remained sealed pending Mr Butler’s arrest.

Following coordination with the U.S. Department of Justice and the Department of Defence Office of Inspector General’s Defense Criminal Investigative Service, Mr Butler was taken into custody Wednesday in Ottawa, Canada, pursuant to an extradition warrant.

In March 2026, U.S. authorities, in partnership with international law enforcement partners, conducted a court-authorised law enforcement operation to seize Command and Control infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad IoT botnets.

According to court documents, KimWolf targeted infected devices which were traditionally “firewalled” from the rest of the internet, such as digital photo frames and web cameras.

The infected devices were enslaved by the botnet operators. The operators then used a “cybercrime as a service” model to sell access to the infected devices to other cybercriminals. The operators and their customers forced the victim devices to participate in DDoS attacks, targeting computers and servers located throughout the world, including Department of Defence Information Network IP addresses.

KimWolf was tied to DDoS attacks which were measured at nearly 30 terabits per second, a record in recorded DDoS attack volume. These attacks resulted in financial losses which, for some victims, exceeded $1 million. The KimWolf botnet is alleged to have issued over 25,000 attack commands.

Law enforcement allegedly connected Mr Butler to the administration of the KimWolf botnet through IP address, online account information, transaction records, and online messaging application records obtained through the issuance of legal process.

In addition to Mr Butler’s arrest, the Central District of California unsealed seizure warrants which targeted online services supporting 45 DDoS-for-hire platforms. These seizures broadly disrupted the DDoS platforms, including at least one that collaborated with Butler’s KimWolf botnet. U.S. authorities also seized domain records associated with many of these services, redirecting them to an authorised “splash page”, which displays a warning to potential visitors that DDoS services are illegal.