Germany Police Dismantle Major Cyberattack Botnets

Investigators from Germany, working with partners in the United States and Canada, shut down major botnets known as Aisuru and Kimwolf, which were used to carry out large-scale Distributed Denial of Service attacks. The networks relied on infected devices like routers and TV boxes, and authorities seized key evidence while identifying suspected operators.

Investigators on Friday announced that they had collaborated with international partners in United States and Canada to dismantle digital infrastructure linked to two major cybercrime networks known as “Aisuru” and “Kimwolf.”
These networks operated as large-scale botnets—vast collections of compromised internet-connected devices—which were used to carry out Distributed Denial of Service attacks. Such attacks work by flooding websites or online services with overwhelming amounts of traffic, often causing them to crash or become inaccessible to legitimate users.
Authorities in Germany, including the Central Office for Combating Cybercrime in North Rhine-Westphalia and the Federal Criminal Police Office (BKA), confirmed that they successfully shut down key technical components of the botnets, which had been distributed across multiple countries. Due to their massive size and ability to launch powerful cyberattacks, both Aisuru and Kimwolf were considered serious threats to global IT infrastructure.
As part of the operation, investigators identified two suspected administrators of the networks and conducted coordinated searches in Germany and Canada. During these raids, law enforcement officials seized a significant amount of evidence, including data storage devices and cryptocurrencies valued at tens of thousands.
Further findings revealed that the Aisuru botnet primarily relied on compromised Internet of Things (IoT) devices, such as routers and webcams, which are often poorly secured. On the other hand, Kimwolf mainly exploited infected Android TV boxes. Notably, Kimwolf’s network was also offered for rent to other cybercriminals, allowing them to disguise malicious traffic as if it were coming from ordinary household devices.
Botnets like these operate by secretly infecting everyday devices—such as smart TVs, routers, and webcams—with malware. Once compromised, these devices can be remotely controlled by hackers without the owners’ knowledge. When orchestrated together, they can generate massive volumes of traffic aimed at a specific target.
In a typical DDoS attack, thousands or even millions of these infected devices simultaneously send requests to a website or server, overwhelming its capacity and forcing it offline. Experts warn that devices with weak passwords, outdated software, or unpatched security vulnerabilities are especially at risk of being recruited into such botnets, highlighting the importance of maintaining strong cybersecurity practices.