Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
Summary
U.S., Canadian, and German authorities have dismantled four IoT botnets—Aisuru, Kimwolf, JackSkid, and Mossad—that compromised over three million devices and launched record-breaking DDoS attacks, including against the Department of Defense.
<p>The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets — named <strong>Aisuru</strong>, <strong>Kimwolf</strong>, <strong>JackSkid</strong> and <strong>Mossad</strong> — are responsible for a series of recent record-smashing distributed denial-of-service (DDoS) attacks capable of knocking nearly any target offline.</p>
<div id="attachment_73083" style="width: 625px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-73083" decoding="async" loading="lazy" class="size-full wp-image-73083" src="https://krebsonsecurity.com/wp-content/uploads/2026/01/ss-botnet.png" alt="" width="615" height="615" /><p id="caption-attachment-73083" class="wp-caption-text">Image: Shutterstock, @Elzicon.</p></div>
<p>The Justice Department said the Department of Defense Office of Inspector General’s (DoDIG) <strong>Defense Criminal Investigative Service</strong> (DCIS) executed seizure warrants targeting multiple U.S.-registered domains, virtual servers, and other infrastructure involved in DDoS attacks against Internet addresses owned by the DoD.</p>
<p>The government alleges the unnamed people in control of the four botnets used their crime machines to launch hundreds of thousands of DDoS attacks, often demanding extortion payments from victims. Some victims reported tens of thousands of dollars in losses and remediation expenses.</p>
<p>The oldest of the botnets — Aisuru — issued more than 200,000 attacks commands, while JackSkid hurled at least 90,000 attacks. Kimwolf issued more than 25,000 attack commands, the government said, while Mossad was blamed for roughy 1,000 digital sieges.</p>
<p>The DOJ <a href="https://www.justice.gov/usao-ak/pr/authorities-disrupt-worlds-largest-iot-ddos-botnets-responsible-record-breaking-attacks" target="_blank" rel="noopener">said</a> the law enforcement action was designed to prevent further infection to victim devices and to limit or eliminate the ability of the botnets to launch future attacks. The case is being investigated by the DCIS with help from the FBI’s field office in Anchorage, Alaska, and the DOJ’s statement credits nearly two dozen technology companies with assisting in the operation.<span id="more-73345"></span></p>
<p>“By working closely with DCIS and our international law enforcement partners, we collectively identified and disrupted criminal infrastructure used to carry out large-scale DDoS attacks,” said Special Agent in Charge <strong>Rebecca Day</strong> of the FBI Anchorage Field Office.</p>
<p>Aisuru emerged in late 2024, and by mid-2025 it was launching <a href="https://krebsonsecurity.com/2025/10/ddos-botnet-aisuru-blankets-us-isps-in-record-ddos/" target="_blank" rel="noopener">record-breaking DDoS attacks</a> as it rapidly infected new IoT devices. In October 2025, Aisuru was used to seed Kimwolf, an Aisuru variant which introduced a novel spreading mechanism that allowed the botnet to infect devices hidden behind the protection of the user’s internal network.</p>
<p>On January 2, 2026, the security firm <strong>Synthient</strong> <a href="https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/" target="_blank" rel="noopener">publicly disclosed</a> the vulnerability Kimwolf was using to propagate so quickly. That disclosure helped curtail Kimwolf’s spread somewhat, but since then several other IoT botnets have emerged that effectively copy Kimwolf’s spreading methods while competing for the same pool of vulnerable devices. According to the DOJ, the JackSkid botnet also sought out systems on internal networks just like Kimwolf.</p>
<p>The DOJ said its disruption of the four botnets coincided with “law enforcement actions” conducted in Canada and Germany targeting individuals who allegedly operated those botnets, although no further details were available on the suspected operators.</p>
<p>In late February, KrebsOnSecurity identified <a href="https://krebsonsecurity.com/2026/02/who-is-the-kimwolf-botmaster-dort/" target="_blank" rel="noopener">a 22-year-old Canadian man</a> as a core operator of the Kimwolf botnet. Multiple sources familiar with the investigation told KrebsOnSecurity the other prime suspect is a 15-year-old living in Germany.</p>
View Cached Full Text
Cached at: 05/16/26, 03:29 AM
# Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
Source: [https://krebsonsecurity.com/2026/03/feds-disrupt-iot-botnets-behind-huge-ddos-attacks/](https://krebsonsecurity.com/2026/03/feds-disrupt-iot-botnets-behind-huge-ddos-attacks/)
The U\.S\. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million Internet of Things \(IoT\) devices, such as routers and web cameras\. The feds say the four botnets — named**Aisuru**,**Kimwolf**,**JackSkid**and**Mossad**— are responsible for a series of recent record\-smashing distributed denial\-of\-service \(DDoS\) attacks capable of knocking nearly any target offline\.
Image: Shutterstock, @Elzicon\.
The Justice Department said the Department of Defense Office of Inspector General’s \(DoDIG\)**Defense Criminal Investigative Service**\(DCIS\) executed seizure warrants targeting multiple U\.S\.\-registered domains, virtual servers, and other infrastructure involved in DDoS attacks against Internet addresses owned by the DoD\.
The government alleges the unnamed people in control of the four botnets used their crime machines to launch hundreds of thousands of DDoS attacks, often demanding extortion payments from victims\. Some victims reported tens of thousands of dollars in losses and remediation expenses\.
The oldest of the botnets — Aisuru — issued more than 200,000 attacks commands, while JackSkid hurled at least 90,000 attacks\. Kimwolf issued more than 25,000 attack commands, the government said, while Mossad was blamed for roughy 1,000 digital sieges\.
The DOJ[said](https://www.justice.gov/usao-ak/pr/authorities-disrupt-worlds-largest-iot-ddos-botnets-responsible-record-breaking-attacks)the law enforcement action was designed to prevent further infection to victim devices and to limit or eliminate the ability of the botnets to launch future attacks\. The case is being investigated by the DCIS with help from the FBI’s field office in Anchorage, Alaska, and the DOJ’s statement credits nearly two dozen technology companies with assisting in the operation\.
“By working closely with DCIS and our international law enforcement partners, we collectively identified and disrupted criminal infrastructure used to carry out large\-scale DDoS attacks,” said Special Agent in Charge**Rebecca Day**of the FBI Anchorage Field Office\.
Aisuru emerged in late 2024, and by mid\-2025 it was launching[record\-breaking DDoS attacks](https://krebsonsecurity.com/2025/10/ddos-botnet-aisuru-blankets-us-isps-in-record-ddos/)as it rapidly infected new IoT devices\. In October 2025, Aisuru was used to seed Kimwolf, an Aisuru variant which introduced a novel spreading mechanism that allowed the botnet to infect devices hidden behind the protection of the user’s internal network\.
On January 2, 2026, the security firm**Synthient**[publicly disclosed](https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/)the vulnerability Kimwolf was using to propagate so quickly\. That disclosure helped curtail Kimwolf’s spread somewhat, but since then several other IoT botnets have emerged that effectively copy Kimwolf’s spreading methods while competing for the same pool of vulnerable devices\. According to the DOJ, the JackSkid botnet also sought out systems on internal networks just like Kimwolf\.
The DOJ said its disruption of the four botnets coincided with “law enforcement actions” conducted in Canada and Germany targeting individuals who allegedly operated those botnets, although no further details were available on the suspected operators\.
In late February, KrebsOnSecurity identified[a 22\-year\-old Canadian man](https://krebsonsecurity.com/2026/02/who-is-the-kimwolf-botmaster-dort/)as a core operator of the Kimwolf botnet\. Multiple sources familiar with the investigation told KrebsOnSecurity the other prime suspect is a 15\-year\-old living in Germany\.
Similar Articles
Botnet of more than 17 million devices dismantled
Dutch authorities, in collaboration with the National Cyber Security Center, dismantled a botnet comprising over 17 million devices managed by 200 servers, linked to Russian proxy service provider ASOCKS.
Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
KrebsOnSecurity reports that a Brazilian anti-DDoS firm, Huge Networks, was compromised and its infrastructure used to launch massive DDoS attacks against other Brazilian ISPs via a botnet of insecure routers and DNS servers.
Disrupting malicious uses of AI by state-affiliated threat actors
OpenAI and Microsoft disrupted five state-affiliated threat actors (from China, Iran, North Korea, and Russia) who were misusing AI services for phishing campaigns, code analysis, and information gathering. The actors were identified and their accounts terminated, with findings showing limited incremental capabilities of GPT-4 for malicious cybersecurity tasks beyond existing tools.
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Dutch authorities arrested two co-owners of hosting companies for providing infrastructure used by Russia in cyberattacks and influence operations, seizing over 800 servers.
OpenAI's Codex chains decade-old DoS techniques into HTTP/2 Bomb
Researchers used OpenAI's Codex agent to chain two decade-old DoS techniques into an HTTP/2 Bomb that can crash vulnerable web servers in seconds, affecting major servers like nginx, Apache, IIS, Envoy, and Pingora.