Formally attributedUnknown

Jacob Butler

Individual member of Scattered Spider, arrested in 2024 as part of law enforcement action against the group.

Attribution signal

?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 Low
8.1
Moderate signal strength
Mentions10
Sources6
High conf.9
Last seenMay 2026
First observed
Last active
Origin
Aliases
1
Techniques
0
Campaigns
0
TargetsTechnologyTelecommunications
RegionsGlobal

Attribution signals

10 mentions · 6 sources
#1chargedhigh
HUMINT
habr
May 2026

"The U.S. Department of Justice reported that charges against the Canadian were filed in the District Court of Alaska."

Campaign: Kimwolf
#2arrested and chargedhigh
HUMINT
bleepingcomputer
May 2026

"U.S. and Canadian authorities arrested and charged a Canadian man with operating the KimWolf distributed denial-of-service (DDoS) botnet"

Campaign: KimWolf
#3high
Infrastructure
cyberscoop
May 2026
Campaign: Kimwolf
#4high
InfrastructureHUMINT
security-affairs
May 2026
Campaign: Kimwolf botnet
#5saidhigh
HUMINT
therecord
May 2026

"the Justice Department said Butler ran KimWolf as a DDoS-for-hire service that infected over a million devices worldwide"

Campaign: KimWolf
#6tied tohigh
HUMINT
therecord
May 2026

"Jacob Butler was arrested in Ottawa on Wednesday after the U.S. Justice Department filed an extradition warrant tied to his operation of the KimWolf botnet"

Campaign: KimWolf
#7saidhigh
HUMINTInfrastructure
therecord
May 2026

"Court documents said Butler was linked to the administration of the KimWolf botnet through his IP address, account information, transactions, online messages and more."

Campaign: KimWolf
#8high
InfrastructureHUMINT
krebs
May 2026
Campaign: Kimwolf botnet
#9identifiedhigh
HUMINT
habr
May 2026

"KrebsOnSecurity identified Butler as the Kimwolf operator by examining his email addresses, registrations on hacker forums, and messages on public Telegram and Discord servers."

Campaign: Kimwolf
#10suspected ofmoderate
HUMINT
habr
May 2026

"Canadian police arrested 23-year-old Ottawa resident Jacob Butler, suspected of creating and managing one of the largest botnets in history — Kimwolf."

Campaign: Kimwolf

Hedge terms observed

arrested and chargedchargedidentifiedsaidsuspected oftied to