Feds Disrupt IoT Botnets Behind Huge DDoS Attacks

2026-03-21T07:23:27Zb02ee2ca8891fac5ec551ed4c9feae86f686def60a904b3a8771ee7f6e25f95e
ai-security-riskaisuruandroid-tv-malwarebadbox-2.0credential-harvestddosextortioni2p-disruptionincident-responseiot-botnetiran-backedjackskidkimwolflaw-enforcement-takedownmfa-bypassmicrosoft-patch-tuesdaymossadphishing-as-a-servicescattered-lapsus-shinyhuntersstarkillerstrykerswattingvulnerability-managementwiperzero-day-trends

What happened

Multiple KrebsOnSecurity reports describe a high-impact period of cyber activity: U.S., Canadian and German authorities disrupted the infrastructure for four massive IoT botnets (Aisuru, Kimwolf, JackSkid and Mossad) that had infected millions of devices and powered record DDoS attacks; the Kimwolf botnet (and its operator “Dort”) continues to conduct disruptive DDoS, doxing and harassment campaigns, swamp the I2P anonymity network, and claim access to other botnets (Badbox 2.0). A new phishing-as-a-service called “Starkiller” proxies real login pages and relays credentials and MFA codes to ev

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
krebs_on_security
Record identifier
b02ee2ca8891fac5ec551ed4c9feae86f686def60a904b3a8771ee7f6e25f95e
Enrichment time
2026-03-21T07:23:27Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.