Skip to main content
Back to the takedown index

Aisuru/KimWolf/JackSkid/Mossad IoT DDoS botnet disruption

March 2026, Malware and botnets
Led by United States Attorney's Office for the District of Alaska, Federal Bureau of Investigation

Corrected and source linked. Verified August 21, 2026.

What was taken down?

C2 infrastructure disrupted across multiple related botnet families.[1][2]

See what happened

What happened to the people?

Officials reported 1 charged and 1 apprehended.
1 charged and 1 apprehended named in the public record.
Group accounted for: Not established

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

US, German, Canadian, Dutch, and private-sector partners disrupted command-and-control infrastructure associated with four related IoT DDoS botnets.[1][2]

Date
March 2026
Target
Aisuru, KimWolf, JackSkid, and Mossad IoT DDoS botnets, iot ddos botnet
Activity
Malware and botnets
Operational lead
USAO-AK and FBI
Partners
BKA, Dutch National Police, and 8 more[1][2]
Jurisdiction
Not established
Outcome
C2 infrastructure disrupted across multiple related botnet families.
Status
Completed
Legal mechanism
Coordinated national judicial/search-and-seizure authority; USAO Alaska-led US component.
Group accounted for
Not established

1
charged
1
apprehended

Named in the public record: 1 charged and 1 apprehended.

Figures count individuals named in charging documents and official statements, each person once per outcome. People alleged to be involved but not publicly identified are not counted.

Reported and named. Officials reported 1 charged and 1 apprehended. 1 charged and 1 apprehended named in the public record. The two figures come from different places and are never added together. Officials publish a headline total, and this index counts only the individuals it can name from the cited record.
Person Role Current public status
Alleged KimWolf administrator ChargedArrestedExtradition requested
Charging authority
United States Attorney's Office for the District of Alaska
Main charges
Aiding and abetting computer intrusion
Case number
Not established in the public record
Arresting authority
Not established in the public record
Arrest location
Ottawa, Canada
Extradition status
Extradition requested, May 2026
Conviction or plea
Not established in the public record
Sentence
Not established in the public record
Segment
Core operator
Sources
[2]
Full record
Everything indexed for Jacob Butler

Jacob Butler

Alleged KimWolf administrator. Current public status: Charged, Arrested, and Extradition requested.

Charging authority
United States Attorney's Office for the District of Alaska
Main charges
Aiding and abetting computer intrusion
Case number
Not established in the public record
Arresting authority
Not established in the public record
Arrest location
Ottawa, Canada
Extradition status
Extradition requested, May 2026
Conviction or plea
Not established in the public record
Sentence
Not established in the public record
Segment
Core operator
Sources
[2]
Full record
Everything indexed for Jacob Butler

Rows expand to show charging authority, case identifiers, custody status, and sources.

Group accounted for: Not established

The cited record does not say how large the group was or whether everyone involved has been identified.

See the organizations and roles behind this action

Jacob Butler, alleged administrator of the KimWolf component, was charged in the District of Alaska on 2026-04-10 and arrested in Canada on 2026-05-20 pursuant to an extradition warrant. The complaint was unsealed May 21; extradition/prosecution remained pending at the cutoff.[1][2]

Not established in the public record. No later activity is recorded against this entry.

The re-verification pass changed 3 values on this record. What was there before is kept below so the change can be checked.

Field Was Now Why it changed
Reported charged count Not recorded 1 Jacob Butler was charged April 10, 2026 in connection with KimWolf. Canadian Man Arrested by International Authorities, Charged with Administrating KimWolf DDoS Botnet, Coordinated disruption of Aisuru, KimWolf, JackSkid, and Mossad IoT DDoS botnets
Reported apprehended count Not recorded 1 Butler was arrested in Ottawa on May 20, 2026 under an extradition warrant. Canadian Man Arrested by International Authorities, Charged with Administrating KimWolf DDoS Botnet, Coordinated disruption of Aisuru, KimWolf, JackSkid, and Mossad IoT DDoS botnets
What happened afterward Not recorded Jacob Butler, alleged administrator of the KimWolf component, was charged in the District of Alaska on 2026-04-10 and arrested in Canada on 2026-05-20 pursuant to an extradition warrant. The complaint was unsealed May 21; extradition/prosecution remained pending at the cutoff. New person/case development after the infrastructure action. Canadian Man Arrested by International Authorities, Charged with Administrating KimWolf DDoS Botnet, Coordinated disruption of Aisuru, KimWolf, JackSkid, and Mossad IoT DDoS botnets

The value that was there before is kept so the change can be checked. See these corrections in the full log.

Numbered markers throughout this entry link to the source that supports the claim beside them.

What each part of this entry rests on

The audit recorded which sources carry which part of the record. These are those sources.

Official sources

  1. [1]
    Coordinated disruption of Aisuru, KimWolf, JackSkid, and Mossad IoT DDoS botnets

    USAO Alaska / US DOJ, March 19, 2026, Source grade S2

    Establishes the multi-country disruption of the four related IoT DDoS botnet families.

    Open source
  2. [2]
    Canadian Man Arrested by International Authorities, Charged with Administrating KimWolf DDoS Botnet

    United States Attorney's Office, District of Alaska, May 21, 2026, Source grade P1

    Jacob Butler charge, Canadian arrest and extradition warrant; related KimWolf infrastructure disruption

    Open source