Who is the Kimwolf Botmaster “Dort”?
2026-03-07T07:23:29Z•47eb304a347332ecf7783c98bf2331eb007cb85870f2371fe25544847c88b5d2
badbox-2.0botmaster-dortcorporate-networkscredential-harvestingddosdoxinggovernment-networksi2piot-botnetkimwolfmfa-bypassmicrosoft-patch-tuesdayphishing-as-a-servicescattered-lapsus-shinyhuntersstarkillerswattingzero-day-patching
What happened
Collection of KrebsOnSecurity stories (Jan–Feb 2026) about the Kimwolf IoT botnet and related threats. Kimwolf has infected over two million devices, is being used for massive DDoS and abusive traffic, is evading takedowns via I2P, has been linked to compromises of Badbox 2.0 and infections in corporate and government networks, and its alleged operator (“Dort”) has coordinated doxing, email-flooding and swatting against researchers. Also covered: a new phishing-as-a-service called “Starkiller” that proxies real login pages and relays credentials and MFA codes to defeat takedown efforts and MFA
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 47eb304a347332ecf7783c98bf2331eb007cb85870f2371fe25544847c88b5d2
- Enrichment time
- 2026-03-07T07:23:29Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.