US, allies move to dismantle four high-volume IoT botnets

The U.S., Canada and Germany on Thursday took steps to dismantle four internet of things botnets responsible for massive distributed denial-of-service (DDoS) attacks around the world.

As part of the operation, the Defense Department inspector general’s Defense Criminal Investigative Service seized U.S.-registered virtual private servers, web domains and other systems that powered the Aisuru, KimWolf, JackSkid and Mossad IoT botnets, the Justice Department said in a statement.

Cyber criminals used the botnets to infect millions of machines, according to prosecutors, especially IoT devices such as routers and webcams.

“As of March 2026, the number of infected devices hijacked worldwide by the botnet administrators exceeded three million, with hundreds of thousands of infected devices located in the United States,” the DOJ said.

Intense attack activity

The botnets’ operators used infected devices to conduct hundreds of thousands of DDoS attacks that sometimes caused tens of thousands of dollars in losses and recovery costs. Cybercriminals also used the threat of botnet attacks to extort victim organizations.

The Aisuru botnet was the most active, with operators issuing more than 200,000 DDoS attack commands. JackSkid generated more than 90,000 commands, KimWolf more than 25,000 and Mossad more than 1,000.

Aisuru often targets critical infrastructure organizations, including in the telecommunications and financial services sectors. Its activity in the third quarter of 2025 helped set records for DDoS attack volume, according to Cloudflare. In October, Microsoft said it had blocked what would have been a record-breaking Aisuru DDoS attack on its Azure cloud platform.

Going after operators too

In tandem with DCIS’s seizure operation, authorities in Germany and Canada also conducted “law enforcement actions” targeting “individuals who operated these botnets.” Security journalist Brian Krebs has reported that KimWolf’s two lead administrators live in those countries.

In addition to DOJ’s foreign government partners, the department also thanked Akamai, Amazon Web Services, Google and other companies for investigative and operational assistance.