Overview
- Jacob Butler, 23, was arrested in Ottawa Wednesday and is in Canadian custody on charges in Canada while a U.S. criminal complaint accusing him of aiding and abetting computer intrusion was unsealed after his arrest.
- U.S. and Canadian investigators say they tied Butler to Kimwolf through IP addresses, account and transaction records, and messaging logs described in a law enforcement affidavit.
- Authorities previously seized core infrastructure for Kimwolf and three related botnets during a coordinated operation in March, but court filings and reporting indicate some botnet activity and residual risk remain.
- Officials say Kimwolf ran as a DDoS‑for‑hire service that issued more than 25,000 attack commands, abused residential‑proxy networks and insecure IoT devices to enslave millions of units, and produced traffic measured at nearly 30 terabits per second that harmed victims including U.S. defense IP ranges.
- Butler is accused of doxing and ordering swatting attacks against researchers, faces Canadian cybercrime counts and up to 10 years under the U.S. charge if extradited and convicted, and investigators warn that systemic IoT weaknesses leave the internet exposed to similar botnets.