Germany: Police dismantle major cyberattack 'botnets'
March 20, 2026
Investigators on Friday said they had worked with partners in the United States and Canada to shut down infrastructure linked to the "Aisuru" and "Kimwolf" networks.
The so-called botnets, made up of millions of infected devices, were used for large-scale Distributed Denial of Service (DDoS) attacks that can overwhelm entire websites and online services.
What do we know about Aisuru and Kimwolf?
The Central Office for Combating Cybercrime in North Rhine-Westphalia (ZAC NRW) and Germany's Federal Criminal Police Office (BKA) said they had shut down technical infrastructure belonging to the botnets scattered around the world. Officials said that, due to their size and associated cyberattack capacity, the networks posed a significant threat to IT infrastructure.
Investigators identified two suspected administrators, carrying out searches in Germany and Canada. They seized extensive evidence including data storage devices and cryptocurrencies worth tens of thousands.
Aisuru is believed to have relied on compromised IoT devices such as routers and webcams, while Kimwolf mainly used infected Android TV boxes. Kimwolf was also rented out to hackers seeking to make it appear that traffic was coming from ordinary household.
How do botnets work?
Hackers can hijack internet-connected devices like smart TVs, routers, and webcams and use them in cyberattacks without owners knowing.
If infected with malware, devices such as televisions or routers can become part of a so-called botnet, controlled remotely to send large volumes of traffic.
In a DDoS attack, thousands or even millions of these compromised devices simultaneously flood a target website or server, overwhelming it and forcing it offline.
Experts say devices with weak passwords, outdated software, or security flaws are especially vulnerable.
Edited by: Kieran Burke