Who is the Kimwolf Botmaster “Dort”?
2026-03-08T13:23:34Z•acc52fb4c241795fed36031d28584efc560fbbc658b8df2a7c1ced04465a59c9
Android TVBadbox 2.0DDoSI2PIoTKimwolfMFA bypassMicrosoft patchesPatch TuesdayScattered Lapsus ShinyHuntersStarkilleranonymity networkbotnetcredential theftdoxingemail floodingexploitation in the wildphishing-as-a-serviceswattingzero-day
What happened
Collection of KrebsOnSecurity reports (Jan–Feb 2026) detailing the emergence and impact of the Kimwolf IoT botnet (over 2 million infected devices), its exploitation of vulnerabilities in unofficial Android TV streaming boxes, and associated disruptive activity (large-scale DDoS, swamping I2P anonymity network, doxing, swatting and email flooding). Related coverage includes ties between Kimwolf and the Badbox 2.0 botnet, a new phishing‑as‑a‑service called “Starkiller” that proxies real login pages and relays credentials and MFA codes to bypass protections, harassment/extortion tactics by Scat
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- acc52fb4c241795fed36031d28584efc560fbbc658b8df2a7c1ced04465a59c9
- Enrichment time
- 2026-03-08T13:23:34Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.