1. Skip to content
  2. Skip to main menu
  3. Skip to more DW sites
CrimeGermany

Germany: Police dismantle major cyberattack 'botnets'

March 20, 2026

German authorities have shut down two of the world’s largest "botnets" as part of a joint three-nation operation. Each of the networks hijacked millions of compromised everyday devices to take part in cyberattacks.

At a cybercrime workshop hosted by the Hessian Ministry of Justice, the activity of a so-called botnet is being illustrated. Specialized software from a security company highlights countries and metropolitan areas with particularly high activity in red, while areas with low infection rates show hardly any color shading
Specialized software highlights countries and metropolitan areas with particularly high botnet activityImage: Boris Roessler/dpa/picture alliance

Investigators on Friday said they had worked with partners in the United States and Canada to shut down infrastructure linked to the "Aisuru" and "Kimwolf" networks.

The so-called botnets, made up of millions of infected devices, were used for large-scale Distributed Denial of Service (DDoS) attacks that can overwhelm entire websites and online services.

What do we know about Aisuru and Kimwolf?

The Central Office for Combating Cybercrime in North Rhine-Westphalia (ZAC NRW) and Germany's Federal Criminal Police Office (BKA) said they had shut down technical infrastructure belonging to the botnets scattered around the world. Officials said that, due to their size and associated cyberattack capacity,  the networks posed a significant threat to IT infrastructure.

Investigators identified two suspected administrators, carrying out searches in Germany and Canada. They seized extensive evidence including data storage devices and cryptocurrencies worth tens of thousands.

Cyberattacks: How secure are smart devices really?

26:04

This browser does not support the video element.

Aisuru is believed to have relied on compromised IoT devices such as routers and webcams, while Kimwolf mainly used infected Android TV boxes. Kimwolf was also rented out to hackers seeking to make it appear that traffic was coming from ordinary household.

How do botnets work?

Hackers can hijack internet-connected devices like smart TVs, routers, and webcams and use them in cyberattacks without owners knowing.

If infected with malware, devices such as televisions or routers can become part of a so-called botnet, controlled remotely to send large volumes of traffic.

In a DDoS attack, thousands or even millions of these compromised devices simultaneously flood a target website or server, overwhelming it and forcing it offline.

Experts say devices with weak passwords, outdated software, or security flaws are especially vulnerable.

Edited by: Kieran Burke

Richard Connor Reporting on stories from around the world, with a particular focus on Europe — especially Germany.
Skip next section DW's Top Story

DW's Top Story

Skip next section More stories from DW

More stories from DW