The Department of Justice (DoJ) in the U.S. announced it took down the infrastructure that controlled several IoT botnets, including AISURU, Kimwolf, JackSkid, and Mossad, through a court-approved operation.

Authorities in Canada and Germany also acted against the people running these botnets, with assistance from companies like Akamai, Amazon Web Services, Cloudflare, DigitalOcean, Google, Lumen, Nokia, Okta, Oracle, PayPal, SpyCloud, Synthient, Team Cymru, Unit 221B, and QiAnXin XLab.

“The four botnets launched DDoS attacks that impacted targets globally,” the DoJ stated. “Some attacks reached roughly 30 Tbps, a record high.”

Cloudflare reported last month that AISURU/Kimwolf was behind a massive 31.4 Tbps DDoS attack in November 2025, which lasted only 35 seconds. The botnet also reportedly launched hyper-volumetric DDoS attacks with an average size of 3 billion packets per second, 4 Tbps, and 54 million requests per second near the end of last year.

Brian Krebs, an independent security journalist, identified Jacob Butler (aka Dort), a 23-year-old from Ottawa, Canada, as the administrator of Kimwolf. Butler told Krebs he hasn’t used the Dort name since 2021 and claimed someone is posing as him after hacking his old account.

Butler also mentioned that “he mostly stays home and assists his mom since he has autism and struggles with social interaction.” According to Krebs, the other leading suspect is a 15-year-old living in Germany. No one has been arrested yet.

The botnet had over 2 million Android devices, mainly compromised, generic Android TVs, as part of its network. It’s estimated that the four botnets collectively infected at least 3 million devices worldwide, including digital video recorders, webcams, and Wi-Fi routers, with hundreds of thousands in the U.S.

“Kimwolf and JackSkid are accused of targeting and infecting devices that are typically ‘firewalled’ from the rest of the internet. The infected devices were controlled by the botnet operators,” the DoJ said. “The operators then used a ‘cybercrime as a service’ approach to provide access to the infected devices to other cyber criminals.”

These devices were then used to launch DDoS attacks against targets globally. Court documents indicate that the four Mirai botnet types sent hundreds of thousands of DDoS attack commands –

• AISURU – >200,000 DDoS attack commands
• Kimwolf – >25,000 DDoS attack commands
• JackSkid – >90,000 DDoS attack commands
• Mossad – >1,000 DDoS attack commands

“Kimwolf was a major change in how botnets work and grow. Instead of scanning the open internet for vulnerable devices like older botnets, Kimwolf used a new attack method: residential proxy networks,” Tom Scholl, VP/Distinguished Engineer at AWS, wrote on LinkedIn.

“By getting into home networks through hacked devices — like streaming TV boxes and other IoT gadgets — the botnet accessed local networks that are usually safe from outside threats because of home routers.”

Lumen Black Lotus Labs told The Hacker News that they blocked nearly 1,000 of the C2 servers used by AISURU and then Kimwolf. According to data from the cybersecurity firm, JackSkid had over 150,000 victims daily in the first two weeks of March 2026, reaching 250,000 on March 8. Mossad had over 100,000 daily victims during the same time.

“The problem is, there are so many vulnerable devices that two things occurred – first, Kimwolf was very resilient,” said Ryan English, a security researcher at Lumen’s Black Lotus Labs. “The second issue was that several new botnets started to copy the technique of exploiting the vulnerability to become very large, very quickly.”

Akamai noted that these high-volume botnets launched attacks exceeding 30 Tbps, 14 billion packets per second, and 300 million requests per second, adding that criminals used them to launch hundreds of thousands of attacks and demand ransom in some situations.

“These attacks can damage important internet infrastructure, significantly degrade service for ISPs and their customers, and even overwhelm strong cloud-based mitigation services,” the web infrastructure company stated.