Who is the Kimwolf Botmaster “Dort”?
2026-03-05T13:23:30Z•5d9a3d8117b5357cbc8a31f112a98bfe1bb400a77ddc274a2b053abfd9da9647
aisuruandroid-tvbadbox-2.0botnetcredential-harvestingddosdoxingi2piotkimwolfmfa-bypassmicrosoft-patch-tuesdayphishing-as-a-servicescattered-lapsus-shinyhuntersstarkillerswattingvulnerability-disclosurezero-day
What happened
Collection of KrebsOnSecurity stories (Jan–Feb 2026) detailing a major IoT botnet (Kimwolf) that has infected over 2 million devices and is being used for massive DDoS, doxing, swatting and other abuse; the botnet’s abuse of anonymity network I2P and its ties to other botnets (Badbox 2.0, Aisuru); identification and harassment by a purported botmaster known as “Dort”; a new phishing-as-a-service called “Starkiller” that proxies real login pages and relays credentials and MFA codes to bypass multi-factor protections; and Microsoft Patch Tuesday advisories fixing dozens of vulnerabilities (seVER
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 5d9a3d8117b5357cbc8a31f112a98bfe1bb400a77ddc274a2b053abfd9da9647
- Enrichment time
- 2026-03-05T13:23:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.