Authorities from the United States, Germany, and Canada have collaborated in a significant operation aimed at dismantling the infrastructure of four major botnets. These networks had infected over 3 million devices globally and were reportedly involved in cyberattacks, including assaults on the websites of the U.S. Department of Defense.
According to reports from Reuters, citing the U.S. Department of Justice and German police, the botnets—named Aisuru, KimWolf, JackSkid, and Mossad—were responsible for hundreds of thousands of Distributed Denial of Service (DDoS) attacks. These attacks overwhelm servers and websites with massive traffic, causing them to become inoperable. Among the targeted entities were IP addresses associated with the U.S. Department of Defense’s information network. In some instances, the operators of these botnets demanded ransom from their victims.
German law enforcement officials have identified two suspected administrators of the botnets. Searches conducted at their residences in Germany and Canada resulted in the seizure of numerous data storage devices and cryptocurrency valued at tens of thousands of dollars.
Most of the infected devices were part of the Internet of Things (IoT), including webcams, video recorders, and Wi-Fi routers. German police noted that many device owners might have been unaware of the infections, particularly those using devices without security updates or with weak passwords.
The KimWolf botnet was also reportedly rented out as a proxy network, allowing third parties to use the infected devices to anonymize their internet traffic without the owners’ consent.
This operation received support from over twenty major technology companies, including Amazon Web Services, Google, PayPal, and Nokia. Additionally, the European law enforcement agency Europol contributed through its PowerOff team, which has been combating DDoS-related cybercrime since 2017.
A joint operation by U.S., German, and Canadian authorities has successfully targeted four major botnets responsible for extensive cyberattacks. The action highlights ongoing efforts to combat cybercrime and protect vulnerable internet-connected devices.