Who is the Kimwolf Botmaster “Dort”?

Between January–February 2026 KrebsOnSecurity documented an emergent, large-scale IoT botnet family dubbed “Kimwolf” (reported at >2 million infected devices) that exploits vulnerabilities in unofficial Android TV streaming boxes and local networks to scan and spread, and that has been used for massive DDoS, doxing, email-flooding and even to trigger SWAT responses. The Kimwolf operators (using the handle “Dort”) have been linked to disruption of the I2P anonymity network and to claims of compromising the Badbox 2.0 control panel. Separately, a new phishing-as-a-service called “Starkiller” was