Dort’s just a kid from Canada.
And here’s the thing — after twenty years chasing Silicon Valley’s hype machines and now pivoting to these cyber underworld tales, I’ve seen enough ‘mysterious masterminds’ unmasked to know: they’re usually bored teens with too much time and a grudge. The Kimwolf Botmaster Dort? Fits the profile perfectly. KrebsOnSecurity just dropped the breadcrumbs, and they lead straight to an Ottawa high schooler named Jacob Butler, born August 2003. Public doxes, leaked forum data, GitHub trails — it’s all there, screaming amateur hour wrapped in botnet bravado.
Who the Hell is Dort, Really?
Start with the basics. A 2020 dox pegged Dort as a Canadian teen, aliases CPacket and M1ce, DOB August 2003. OSINT Industries ties CPacket to a 2017 GitHub under Dort and [email protected]. Intel 471 chimes in: that email hit cybercrime haunts like Nulled (Uubuntuu) and Cracked (Dorted), all from a Rogers Canada IP. Cozy.
But wait — Dort wasn’t born evil. Nah, this punk cut teeth on Minecraft. “Dortware,” his cheat software, made him infamous in Microsoft lobbies. Cheating pixels? Harmless fun, until it isn’t. Graduated to DortDev on LAPSUS$ Telegram chats in 2022, hawking temp emails and CAPTCHA crackers like Dortsolver. SIM Land posts show him teaming with “Qoft” — real name Jacob, apparently — ripping off $250k in Xbox Game Pass accounts via stolen cards.
“I legit just work with Jacob,” Qoft said in 2022 in reply to another user, referring to their exclusive business partner Dort.
That’s straight from Flashpoint’s index. Qoft bragging about the heists? Classic small-time flex.
Jacob Butler. Constella Intelligence links jay.miner232’s password to [email protected]. DomainTools: that email grabbed Minecraft domains in 2015, tied to Jacob Butler in Ottawa, phone 613-909-9727. Nulled account in 2016, M1CE on Minecraft. Password echoes to [email protected] and [email protected] — Ottawa-Carleton District School Board. Kid was logging in from school, folks.
Spycloud peeks at the family PC: Jacob sharing with mom and sib, password “jacobsplugs.” Epieos nails jacobbutler803 to GitHub MemeClient, Pastebin crediting CPacket. It’s a neon signpost back to Dort.
One short sentence: sloppy opsec from day one.
Why’s This Botnet Brat Swatting Researchers?
Kimwolf hit headlines early 2026 — world’s biggest botnet, exploiting residential proxy vulns to hijack your smart TV or photo frame for DDoS armies. Benjamin Brundage at Synthient cracked it open; Krebs published January 2. Proxies patched fast, botnet growth stalled. Hours later? Dort spins up a fake Krebs Discord, doxxing Brundage and Krebs, threats flying, even a SWAT call to the researcher’s house.
Petulant. That’s the word. Kid’s empire — built on forgotten IoT junk — gets neutered by a blog post, so he tantrums with email floods and doxing. Who makes money? Dort, funneling attacks for hire, but now he’s burning bridges, leaking his rage across public channels.
Look, I’ve covered botnets since Mirai’s diaper days in 2016 — remember those US teen geniuses? Jailed quick, careers torched. Dort’s trajectory? Identical. Starts gaming cheats (check), forum hustles (check), scales to malware (Kimwolf). But Mirai kids got pinched because they bragged. Dort’s Discord meltdown? Same mistake. Feds love OSINT trails like this.
My unique bet: by summer, RCMP or FBI door-kicks Jacob Butler. He’s 23 now, but that school email won’t save him. Prediction — not hype, pattern recognition.
And the cynicism? Krebs gets swatted, researcher terrorized, while Dort hides behind anon handles. Proxy services cleaned up — good. But who’s liable for the botnet’s prior sins? Victims worldwide, yet the kid’s the star.
Is Kimwolf’s Reign Ending for Good?
Kimwolf stalked local nets via proxy flaws — TV boxes, frames, anything plugged in. Brundage notified providers; fixed overnight. Dort’s response? Fury. But botnets die slow. Remnants could lurk, repurposed for quieter gigs — credential stuffing, maybe crypto scams.
Here’s the sprawl: these things evolve, sure, but Dort’s profile screams burnout. From Minecraft mods to LAPSUS$ side-hustles with Qoft (stealing Game Passes? Peanuts), now mega-botnet. Money’s there — DDoS-for-hire pulls five figures monthly — but heat’s rising. Public dox from 2020? Still online. GitHubs linking emails? Dumb. Families non-responsive to Krebs? Guilt or fear.
Medium thought: Ottawa’s no hacker haven. Rogers IPs geolocate precise; school domains scream local. One subpoena, game’s over.
Corporate spin angle? None here — Krebs is raw OSINT, no PR gloss. But cybercrime forums like Nulled? Ghost towns now, victims of their own leaks.
Single punch: Dort’s mad because he lost.
Deep dive time. LAPSUS$ was flashy — airline hacks, Uber breaches — but folded under arrests. DortDev peddling CAPTCHAs there? Associate risk. Qoft-Jacob duo snagged 250k in accounts — sloppy, traceable via card data trails. Intel 471, Flashpoint, Constella — firms feasting on this slop, selling reports to corps. Who’s really profiting? Them, not Dort.
Historical parallel I love: 2014’s Lizard Squad, teen DDoS crew SWATting Xbox Live. Leaders nabbed young, just like this. Dort’s SWAT stunt on Brundage? Echoes exactly. Pattern: game rage to crime to cuffs.
The Bigger Picture: Kids to Cyber Kings?
Twenty years in, I’ve watched Valley kids code apps to billions — or jail. Dort chose wrong fork. Minecraft cheats teach automation; add forums, boom — botnets. But ethics? MIA.
Question for devs: why do proxies still leak local nets? Sloppy design. Fix it, or feed more Dorts.
Wander: imagine Jacob at OCDSB, coding Dortware between classes. Mom on same PC? Password shares? Human error city.
Final cynical twist: Krebs’ post slowed Kimwolf cold. Hero move. Dort’s retaliation? Proves he’s cornered.
🧬 Related Insights
Frequently Asked Questions
Who is the Kimwolf Botmaster Dort? Jacob Butler, Ottawa teen linked via emails, IPs, and doxes to Dort, CPacket, M1ce.
What is the Kimwolf botnet? Massive IoT army exploiting proxy vulns for DDoS, doxing, built by Dort post-Minecraft cheats.
Has Dort been arrested yet? Not publicly, but OSINT trails make it inevitable — watch RCMP.
