Who is the Kimwolf Botmaster “Dort”?

Multiple KrebsOnSecurity pieces in early 2026 describe a large, active cybercrime ecosystem centered on the Kimwolf IoT botnet (over 2 million infected devices) that scans local networks, conducts massive DDoS attacks, relays abusive traffic, and has been used to compromise other botnets (e.g., Badbox 2.0). The Kimwolf operators (notably a handle “Dort”) have coordinated harassment, doxing, email flooding and even SWATing of researchers; Kimwolf has been leveraging anonymity networks such as I2P to resist takedown. Separately, a stealthy phishing-as-a-service called “Starkiller” proxies real,