Who is the Kimwolf Botmaster “Dort”?
2026-03-07T13:23:30Z•d961de561336de9183dfe633b6488c681e2ccab3c5ba8160608800538ea56748
AisuruAndroid-TVBadbox 2.0DDoSI2PIoTKimwolfMFA-bypassPatch-TuesdayStarkilleraccount-takeoverbotnetdoxingphishingphishing-as-a-servicesecurity-researcher-targetingsupply-chainswattingtakedown-evasionvulnerability-disclosureszero-day
What happened
This collection of KrebsOnSecurity posts (Jan–Feb 2026) centers on the emergence and impact of the Kimwolf IoT botnet — now exceeding ~2 million infected devices — which has been used for massive DDoS, network scanning, abuse of anonymity networks (I2P), takeover of other botnet control panels (Badbox 2.0), and targeted harassment (doxing, swatting) of researchers and journalists. Related reporting covers a sophisticated phishing-as-a-service called “Starkiller” that proxies real login pages and relays credentials and MFA codes to facilitate account takeover, and multiple Microsoft Patch-Tues
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- d961de561336de9183dfe633b6488c681e2ccab3c5ba8160608800538ea56748
- Enrichment time
- 2026-03-07T13:23:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.