🌐 Smart devices
🚔 Arrest
KimWolf Busted: Your Router, Camera or Smart TV May Have Been Used as a Weapon by Hackers — Without You Knowing
Jacob Butler, 23, has just been arrested in Ottawa, Canada for creating and operating KimWolf — one of the most devastating IoT botnets of 2026. This criminal network infected millions of connected devices worldwide: routers, surveillance cameras, printers, Smart TVs. Without their owners knowing, these devices were used to launch massive cyberattacks. Your home may have been involved — here's how to check.
Millions
Devices infected worldwide
23 ans
Age of creator — Jacob Butler, aka "Dort"
6 mois
Of massive DDoS attacks before arrest
🤔 What is a botnet — and why it concerns you
A botnet (short for "robot network") is a network of devices infected by malware, secretly controlled remotely by a hacker. The owners of these devices know absolutely nothing — their router or camera appears to function normally, but simultaneously obeys the hacker's commands.
KimWolf used these millions of devices as an invisible army to launch DDoS attacks — simultaneously flooding websites with traffic until they crashed. Hospitals, banks, public services and businesses were paralysed by these attacks.
📱 Which devices did KimWolf target?
Router / Modem
⚠️ Target #1
Surveillance camera
⚠️ Highly targeted
Smart TV
⚠️ Vulnerable
Connected printer
⚠️ Often forgotten
Smart bulbs
⚠️ Rarely updated
Speaker / Voice assistant
⚠️ Always on
🎯 How KimWolf infected your device
⚙️ The infection mechanism explained simply
1
Automated scanning — KimWolf continuously scanned the internet looking for connected devices with default credentials ("admin/admin", "admin/1234", "root/root"). Billions of devices have never had their passwords changed.
2
Silent connection — Once credentials were found, the malware connected to the device and installed itself silently. No notification, no visible sign for the owner.
3
Army enrolment — The device automatically joined the KimWolf botnet and awaited orders. It continued to function normally — just slightly slower, slightly warmer.
4
On-demand attack — When Butler wanted to attack a site, he sent a signal. Millions of devices simultaneously bombarded the target with requests, bringing it down under the weight of traffic.
🕵️ Jacob Butler — the hacker's profile
Jacob Butler, alias "Dort", 23, from Ottawa, Canada, is described by KrebsOnSecurity as a particularly aggressive individual. After renowned cybersecurity journalist Brian Krebs published his first investigations into KimWolf, Butler responded with a series of DDoS attacks, doxing and swatting targeting Krebs and other researchers directly.
This escalation accelerated his identification. He now faces criminal charges in Canada and the United States for botnet operation, unauthorised access to computer systems and DDoS attacks.
⚠️ Signs your device may have been infected
- Your internet connection was unusually slow for no apparent reason
- Your router or modem was running hotter than usual
- Your data consumption was abnormally high
- Your connected devices restarted on their own from time to time
- The activity LED on your router was constantly flashing even with no usage
🛡️ How to protect your connected home
✅ The 6 steps that protect all your devices
- Change the default passwords on ALL your devices — router, camera, printer, Smart TV. "admin/admin" is a welcome mat for hackers.
- Update the firmware regularly — go into each device's settings and look for "Update" or "Firmware update". It's often automatic if enabled.
- Disable remote access if you don't need it — UPnP, SSH access, remote admin. Fewer open doors = fewer risks.
- Restart your router regularly — a weekly restart is enough to flush some malware from RAM.
- Create a separate WiFi network for your IoT devices — most routers allow you to create a dedicated "guest" network. If one device is infected, it can't reach your computers.
- Buy recognised brands — cheap cameras and routers from unknown brands often never receive security updates.
💡 What you can do right now in 5 minutes
- Open your browser and type 192.168.1.1 or 192.168.0.1 — that's your router's interface
- Log in (often admin/admin or the credentials on the label on the back of your router)
- Look for "Change password" and set a new strong password
- Look for "Firmware" or "Update" and check if an update is available
- Disable "UPnP" if you see this option — unnecessary for 99% of people
❓ Questions fréquentes
Signs: slow internet for no reason, router running hot, abnormal data consumption. To check, restart all your connected devices, change default passwords and update their firmware. A network antivirus can also scan your home network.
A botnet is a network of infected devices controlled remotely by a hacker without their owners knowing. These devices are used to launch DDoS attacks, send spam, mine cryptocurrency or serve as relays for other attacks. Your router can be infected with no visible sign.
Most targeted: routers and modems (especially with default credentials), cheap IP cameras, connected printers, Smart TVs and voice assistants. Cheap devices from unknown brands are particularly vulnerable as they never receive security updates.
1) Change default passwords on ALL your devices. 2) Update firmware regularly. 3) Disable remote access if unnecessary. 4) Buy recognised brands. 5) Create a separate WiFi network for IoT devices. 6) Restart your router regularly.
💡 Vous aimerez peut-être aussi
Concerns about the security of your connected devices?
CyberGuard guides you to secure your connected home — free and jargon-free.
🤖 Talk to CyberGuard →📖 Complete guide — Protect Your Family Online
30 pages · Smart devices, viruses, scams · Instant PDF