Ottawa man arrested in alleged Kimwolf botnet case faces Canadian and U.S. charges
Ontario Provincial Police arrested a 23-year-old Ottawa man on May 20 on a U.S. extradition warrant over his alleged role in running Kimwolf, a botnet of hijacked internet-connected devices that U.S. prosecutors link to some of the largest distributed denial-of-service attacks ever recorded.
The case is one of the most significant Canadian cybercrime arrests of the year and shows the growing co-operation between Canadian police and U.S. agencies on botnets built from cheap consumer devices such as cameras and streaming boxes.
The charges
A criminal complaint unsealed in U.S. District Court in Alaska charges Jacob Butler with one count of aiding and abetting computer intrusion, which carries a maximum of 10 years in prison, The Record reported. The complaint was filed April 10 and kept sealed until the arrest.
In Canada, Butler faces charges of unauthorized use of a computer, possession of a device to obtain unauthorized use of a computer system or to commit mischief, and mischief in relation to computer data, according to KrebsOnSecurity. He was in custody with a hearing scheduled for May 26. The allegations have not been tested in court.
What prosecutors allege
U.S. prosecutors allege Kimwolf operated as a DDoS-for-hire service and infected more than a million devices worldwide, often consumer gear sitting behind home firewalls such as digital photo frames, web cameras and TV streaming boxes. The Justice Department said the botnet was tied to attacks measured at nearly 30 terabits per second and that more than 25,000 attack commands were issued. Some victims reportedly lost more than $1 million, and at least one attack hit internet address ranges used by the U.S. Department of Defense.
The Defense Criminal Investigative Service is leading the U.S. investigation with help from the FBI. The OPP executed a search warrant at Butler's Ottawa address on March 19, the same day an international operation involving the United States, Canada and Germany seized infrastructure used by Kimwolf and other botnets, including Aisuru.
KrebsOnSecurity had publicly identified Butler in February as the person behind the online persona "Dort." Butler has denied being Dort, The Record reported.
What to do
- Replace or update cheap internet-connected devices that no longer receive firmware updates.
- Change default passwords on cameras, routers and media boxes, and disable remote access features you do not use.
- Organizations should confirm their DDoS protection covers volumetric attacks, given the scale these botnets reach.
