THU 02 JUL 2026 · GMT EDITION A WHITESTONE INTELLIGENCE PUBLICATION
MARKETS · CYBER · MEMOS · MODELS
DAILY ISSUES26 MAY27 MAY28 MAY29 MAY30 MAY31 MAY01 JUN02 JUN03 JUN04 JUN05 JUN06 JUN07 JUN08 JUN09 JUN10 JUN11 JUN12 JUN13 JUN14 JUN15 JUN16 JUN17 JUN18 JUN19 JUN21 JUN22 JUN23 JUN24 JUN25 JUN26 JUN27 JUN28 JUN29 JUN30 JUN01 JUN02 JUNALL ›
FRONT PAGE / CYBER / CYB-2026-05-21-F1
CYBER · ransomware threat groups · 2026-05-21SCOOP 55

Alleged Kimwolf IoT botnet operator 'Dort' arrested in Ottawa, charged in US and Canada

Per KrebsOnSecurity's May 21 report, Canadian authorities arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast-spreading Internet-of-Things botnet that enslaved millions of devices for.

·FILED 2026-05-21·1 MIN READ·RE-VERIFIED 2026-07-02 UTC·✓ RE-VERIFIED 2026-07-02

At a glance

  • Canadian authorities arrested a 23-year-old Ottawa man suspected of operating the Kimwolf IoT botnet, which enslaved millions of devices for DDoS attacks, per KrebsOnSecurity
  • The suspect faces criminal hacking charges in both Canada and the United States

VERDICT — CONFIRMED

pipeline-backfill confidence · primary + corroborating sources verified · re-verified 2026-07-02 UTC
Cyber desk illustration
Generated desk illustration · The Dossier Wire · not a photograph

Per KrebsOnSecurity's May 21 report, Canadian authorities arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast-spreading Internet-of-Things botnet that enslaved millions of devices for a series of massive DDoS attacks over the prior six months. Krebs had publicly named the suspect in February 2026 after the accused launched DDoS, doxing and swatting campaigns against the author and a security researcher. The suspect faces criminal hacking charges in both Canada and the United States.

Key facts on file

  • Canadian authorities arrested a 23-year-old Ottawa man suspected of operating the Kimwolf IoT botnet, which enslaved millions of devices for DDoS attacks, per KrebsOnSecurity
  • The suspect faces criminal hacking charges in both Canada and the United States

PRIMARY SOURCE

Krebs on Security
— (2026-05-21) · fetched at filing · archived at publication

Sources · two-source rule

PRIMARYKrebs on Security— (2026-05-21)
Share
Filed by the Cyber desk · verified by the verification desk · re-verified 2026-07-02 · Our standards: the two-source rule ›
CITE THIS FILE — The Dossier Wire · cyb-2026-05-21-f1 · filed 2026-05-21 · https://thedwire.com/wire/cyb-2026-05-21-f1-alleged-kimwolf-iot-botnet-operator-dort-arrested-in-ottawa.html · Primary and corroborating sources listed above; archived at publication. Republishing & licensing: hello@thedwire.com.
More from Cyber FULL DESK ›
Cyber desk illustration
Generated desk illustration · not a photograph
CYBER · SCOOP 58

CISA contractor exposed AWS GovCloud keys and internal agency systems in public GitHub repository

KrebsOnSecurity reported May 18 that a contractor for CISA maintained, until the preceding weekend, a public GitHub repository exposing credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Per the report, the archive included files detailing how CISA builds, tests and deploys software

✓ verifiednewSOURCE ↗
READ THE FILE ›
Microsoft Confirms Active Exploitation of Unpatched On-Prem Exchange Zero-Day (C
SecurityWeek
CYBER · SCOOP 76

Microsoft Confirms Active Exploitation of Unpatched On-Prem Exchange Zero-Day (CVE-2026-42897) via Crafted Email

Microsoft disclosed CVE-2026-42897 on May 14, 2026, a spoofing and cross-site-scripting (XSS) zero-day in on-premises Microsoft Exchange Server that it confirmed is being actively exploited in the wild. Microsoft characterizes the flaw as 'improper neutralization of input during web page generation' that allows an unauthorized attacker to

✓ verified
READ THE FILE ›
GTIG details 'BlackFile' vishing extortion operation by UNC6671 target
Photo: KK IN HK · via Wikimedia Commons · Public domain
CYBER · SCOOP 55

GTIG details 'BlackFile' vishing extortion operation by UNC6671 targeting Microsoft 365 and Okta

Per Google Threat Intelligence Group's May 15 report, threat actor UNC6671 — operating under the "BlackFile" brand — is running an expansive extortion campaign that pairs voice phishing with single sign-on compromise. GTIG says the group uses adversary-in-the-middle techniques to bypass perimeter defenses and multi-factor authentication,

✓ verifiednewSOURCE ↗
READ THE FILE ›

The morning wire in your inbox — every brief, primary sources linked, no noise.

Free tier. The Wire — continuous desk briefs · Records archive · Bureau alerts.

Stored to the wire's subscriber list. No spam, unsubscribe any time.