Who is the Kimwolf Botmaster “Dort”?

KrebsOnSecurity published a series of reports (Jan–Feb 2026) on the disruptive Kimwolf IoT botnet (reported >2M infected devices) and its botmasters (handle “Dort”), detailing widespread DDoS, doxing, email-flooding and even SWATing tied to the group. Kimwolf has been used to swamp the I2P anonymity network, to compromise other botnets (Badbox 2.0) and to scan/local-network-infect corporate and government environments; infection vectors include compromised Android TV boxes. Separately, a new phishing-as-a-service called “Starkiller” transparently proxies real login pages and relays credentials