Who is the Kimwolf Botmaster “Dort”?

Multiple KrebsOnSecurity posts (Jan–Feb 2026) detail a severe, large-scale threat landscape centered on the Kimwolf IoT botnet (reported >2 million infected devices) that scans local networks to spread, powers massive DDoS attacks, and has been used to swamp the I2P anonymity network and to compromise other botnets (Badbox 2.0). The Kimwolf operators (including a handle “Dort”) have engaged in doxing, email flooding and even swatting against researchers and journalists. A separate novel phishing-as-a-service called “Starkiller” transparently proxies real login pages and relays MFA codes to the