Who is the Kimwolf Botmaster “Dort”?

A collection of KrebsOnSecurity reports from Jan–Feb 2026 documenting the rise and impact of the Kimwolf IoT botnet (now >2M devices), its suspected operator known as “Dort,” ties to other botnets (Badbox 2.0, Aisuru), and its operational tactics: mass compromise of unofficial Android TV streaming boxes via a long-exploited vulnerability, local network scanning, massive DDoS, relaying/abusive traffic, doxing, swatting and use of I2P to evade takedowns. Separately, a new phishing-as-a-service called “Starkiller” transparently proxies real login pages and relays credentials and MFA codes to the/