Who is the Kimwolf Botmaster “Dort”?

Between January–February 2026 KrebsOnSecurity published a series of investigations describing a large, active IoT botnet (Kimwolf) and related threats. Kimwolf has infected more than 2 million devices—primarily unofficial Android TV streaming boxes—by exploiting a vulnerability that lets it scan and compromise devices on local networks. It has been used for massive DDoS attacks, to relay abusive traffic, to evade takedowns via I2P, and to compromise or claim compromise of other botnets (e.g., Badbox 2.0). The apparent Kimwolf operator known as “Dort” has coordinated harassment against security