Counterintelligence & Tradecraft — 2026-05-22

Alleged Kimwolf Botmaster Arrested in Canada, Faces US Charges for Record DDoS Attacks

BLUFDespite Butler's arrest, KimWolf's resumed operations show the threat persists, and his extradition to the United States within the next twelve months is unlikely given parallel Canadian prosecution.

Canadian authorities arrested Jacob Butler, 23, of Ottawa on Wednesday pursuant to a U.S. extradition warrant, and the DOJ unsealed a criminal complaint in the District of Alaska charging him with one count of aiding and abetting computer intrusion 12. According to the complaint, KimWolf infected over one million devices and generated DDoS attacks measuring nearly 30 terabits per second, which the DOJ characterized as a record; the botnet issued more than 25,000 attack commands and targeted Department of Defense Information Network addresses 1. Butler also faces Canadian charges including unauthorized use of a computer and mischief relating to computer data, with a custody hearing set for May 26 2. CyberScoop, citing court records, reported that KimWolf has resumed operation despite the March seizure of its command-and-control infrastructure 3.

Analysis
KimWolf's resumption despite the March C2 seizure, confirmed by independent court records converging with DOJ filings, signals Butler's arrest has not neutralized the threat. Extradition to the United States within the next twelve months is unlikely: parallel Canadian prosecution is already underway, and Canada-US proceedings routinely extend well beyond a year when a defendant simultaneously faces domestic charges. DoD Information Network targeting sustains DCIS and FBI investigative priority regardless of transfer timing, keeping US prosecution on hold through a prolonged extradition phase. Butler's documented operational security failures leave open the possibility that cooperation is already underway, which could accelerate extradition and partially degrade remaining infrastructure. High confidence reflects consistent Canada-US extradition precedent and independent court-record confirmation of dual parallel proceedings.
3 sources
  1. Canadian Man Arrested by International Authorities, Charged with Administrating KimWolf DDoS Botnet - U.S. Department of Justice
  2. Alleged Kimwolf Botmaster Dort Arrested, Charged in U.S. and Canada - Krebs on Security
  3. Alleged leader of Kimwolf, a sweeping botnet for cybercriminals, arrested in Canada - CyberScoop

View in full brief →

UNCLASSIFIED // OPEN SOURCE