Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
2026-03-21T07:23:27Z•b02ee2ca8891fac5ec551ed4c9feae86f686def60a904b3a8771ee7f6e25f95e
ai-security-riskaisuruandroid-tv-malwarebadbox-2.0credential-harvestddosextortioni2p-disruptionincident-responseiot-botnetiran-backedjackskidkimwolflaw-enforcement-takedownmfa-bypassmicrosoft-patch-tuesdaymossadphishing-as-a-servicescattered-lapsus-shinyhuntersstarkillerstrykerswattingvulnerability-managementwiperzero-day-trends
What happened
Multiple KrebsOnSecurity reports describe a high-impact period of cyber activity: U.S., Canadian and German authorities disrupted the infrastructure for four massive IoT botnets (Aisuru, Kimwolf, JackSkid and Mossad) that had infected millions of devices and powered record DDoS attacks; the Kimwolf botnet (and its operator “Dort”) continues to conduct disruptive DDoS, doxing and harassment campaigns, swamp the I2P anonymity network, and claim access to other botnets (Badbox 2.0). A new phishing-as-a-service called “Starkiller” proxies real login pages and relays credentials and MFA codes to ev
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- b02ee2ca8891fac5ec551ed4c9feae86f686def60a904b3a8771ee7f6e25f95e
- Enrichment time
- 2026-03-21T07:23:27Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.