Who is the Kimwolf Botmaster “Dort”?

A series of KrebsOnSecurity reports from Jan–Feb 2026 describe the rise and active abuse of the Kimwolf IoT botnet (over 2 million infected devices), which spreads via compromised Android TV streaming boxes, scans local networks for additional targets, and is being used for massive DDoS attacks, network-level relaying of abusive traffic, doxing and swatting. The Kimwolf operators (who appear to be retaliating against researchers and journalists; the handle “Dort” is implicated) have also leveraged anonymity infrastructure (I2P) to evade takedowns and claimed access to control panels for other,