Who is the Kimwolf Botmaster “Dort”?

A series of KrebsOnSecurity reports in early 2026 describe the rise and operations of the Kimwolf IoT botnet (now >2 million infected devices), its use of mass-compromised Android TV streaming boxes and local network scanning to spread, and disruptive activities including large-scale DDoS, relayed abusive traffic, doxing, email-flooding and even swatting against researchers. Kimwolf operators (handle “Dort”) have leveraged I2P to evade takedowns and have boasted of compromising other botnets’ control panels (Badbox 2.0). Separately, a new phishing-as-a-service called “Starkiller” proxies real,