The College Student Who Defeated the World’s Biggest Cyberweapon

Podcast: The Journal
Hosts: Ryan Knutson & Jessica Mendoza
Episode Date: May 1, 2026

Overview:

This episode of The Journal delves into the extraordinary story of Benjamin Brundage, a 22-year-old computer science student at RIT, who played a critical role in identifying and dismantling the world’s most extensive botnet cyberweapon—Kim Wolf. The episode explores how Ben, operating out of his dorm room, uncovered the network’s mechanisms, outwitted global hackers, and collaborated with elite cybersecurity experts to neutralize the threat.

The core themes are the vulnerability of consumer devices, the blurred boundaries of the "shady" internet, and how a curious college student tipped the balance in favor of the “Internet wizards” who keep the web safe.

Key Discussion Points & Insights

1. Introduction to Kim Wolf – The Unprecedented Botnet (00:05–02:04)

Kim Wolf was a fast-growing botnet that quietly hijacked nearly 2 million Android devices globally (00:38).
Its primary attack method: massive Distributed Denial of Service (DDoS) attacks coming from everyday devices—phones, cameras, TV boxes—rendering targets inaccessible by flooding them with junk data (01:04).
"The concern here was that they could knock out the Internet...the message was be afraid, be very afraid." — Bob McMillan, cybersecurity reporter (01:46).

2. Benjamin Brundage’s Unlikely Path (04:11–10:04)

Ben’s early life was not computer-focused; he preferred hiking and skiing (04:21), but the COVID lockdowns and a Minecraft obsession drew him into coding and ultimately, hacking culture.
His initial foray included building mods and cheats in Minecraft, sometimes getting accounts banned (06:16).
Online gamer chat rooms (Discord) exposed him to more serious hacking and cybercrime communities, leading to a moral crossroads.
- "If you spend all your time around these communities... things you would view as immoral or wrong start to become normalized." — Ben (07:37)
Ben once discovered a dump of stolen Spotify credentials and, disturbed, emailed the victims—a moment steering him toward ethical hacking (08:42).
His first bug bounties were with the Dutch government, earning only a T-shirt: “Hack the Dutch government and all I got was this lousy T shirt” (09:55).

3. The Shady World of Residential Proxies (10:40–13:37)

Ben’s curiosity shifted to “residential proxy networks”—services that let users “rent out” their home IP addresses, often unknowingly, via infected devices or dodgy apps.
These proxies are misused for a wide range of crime (11:43–12:07): from hacking and ticket scalping to nation-state attacks.
- Bob McMillan: “It’s basically any kind of crime you can think about that happens on the Internet. Happens with residential proxy networks.” (11:58)
Many devices are compromised via free streaming apps or IoT gadgets with malware preinstalled.

4. Ben’s Discovery: A Single Shady Company Behind Many Proxies (15:05–16:49)

Ben noted many residential proxy sites had identical layouts—one company, “IP Idea,” operated under dozens of names with virtually no security or regulation.
- “IP Idea had no regulations...they didn’t have guardrails to prevent their users from committing fraud. The fact that they didn’t stood out.” — Ben (15:51)

5. The Encounter with a Hacker & Realization of Kim Wolf (16:49–19:12)

Ben published a tool to detect if an IP was part of a res proxy network. A hacker messaged him, boasting Ben’s list missed many compromised IPs and dropping hints about an “operation” spending $30,000 a month in infrastructure (17:08–18:47).
- “This isn’t some rinky dink operation...don’t investigate us, essentially.” — Hacker (18:47)
Ben’s suspicions grew, realizing this was connected to the much bigger Kim Wolf botnet.

6. Joining the “Internet Wizards” – The Cybersecurity Team-Up (19:12–22:35)

Chris Formosa, engineer at network company Lumen, had also been investigating IP Idea. He and Ben connected and collaborated intensely (21:47–21:58).
- “Ben kind of figured almost all of it out just by himself, which is nothing short of amazing.” — Chris (21:47)
Chris introduced Ben to “Big Pipes”, a coalition of top cybersecurity experts from major companies, who embraced Ben’s insights.

7. The Breakthrough: Tracing the Attack to a Picture Frame (23:18–24:28)

The Big Pipes team noticed a DDoS attack coming from inside their own ranks: a $50 digital picture frame belonging to an employee (23:57).
- This device was unwittingly part of Kim Wolf's arsenal, showing how consumer IoT devices were weaponized.

8. Ben’s Honeypot Sets the Trap for Kim Wolf (25:18–28:56)

Ben set up an Android honeypot by installing suspicious IP Idea software from a pirated streaming site (25:53).
He detected a suspicious domain ("XD Resi to") accessing his device—evidence of the hacking mechanism (26:31–26:53).
The “tunnel” of a residential proxy was subverted: hackers used it to access and exploit local networks, not just to route external internet traffic (27:29–27:55).
- Bob McMillan: “Instead of going to another place on the Internet, the hackers were saying, take us to someplace on your local network...where we can get control of your whole phone or your whole picture frame...” (27:29)

9. The Fix & Takedown—Victory (28:56–32:29)

Ben and Big Pipes determined Kim Wolf exploited a bug in IP Idea’s software, allowing hijack of devices for DDoS attacks—without IP Idea’s knowledge.
Ben identified 2 million infected devices, affecting a dozen other proxy companies, and notified vendors (28:56).
Major action followed:
- Dec 17: Ben sends warnings post-finals (29:44).
- Jan: Google, via court order, seizes IP Idea domains and servers; 10 million compromised devices are revealed (30:09).
- March: DOJ seizes Kim Wolf’s infrastructure after 26,000 attacks (30:26). Ben and his company "Synthient" are credited by DOJ (31:35).
“Ben was the most important, critical MVP, whatever you want to call it.” — Chris Formosa (32:05)

10. The Internet’s Pollution Problem (33:01–34:15)

Despite Kim Wolf’s takedown, thousands of devices globally remain compromised.
- “The real takeaway here is that we have an Internet filled with junk—garbage devices, garbage apps... It’s like an Internet pollution problem.” — Bob McMillan (33:14)
Listeners are pointed to Bob’s guide on checking their networks for infected devices.

11. Ben’s Reflection & Next Steps (33:58–34:33)

“It’s a really cool feeling...it’s also like rewarding...spent all this time...there’s real world value to what I’m doing.” — Ben (31:35)
Ben plans to graduate, build his company, and—finally—take a break.

Notable Quotes & Moments

Bob McMillan (on the scale of Kim Wolf):
"The concern here was that they could knock out the Internet." (01:46)
Ben Brundage (on encountering cybercrime):
“Things you would view as immoral or wrong start to become normalized.” (07:37)
Chris Formosa (on Ben’s key role):
“Ben was the most important, critical MVP, whatever you want to call it.” (32:05)
Ben Brundage (on the accident of impact):
“This all was by, you know, accident, but it's...rewarding... there's an actual impact, or...real world value to what I'm doing.” (31:35)
Bob McMillan (on what’s next):
“We have an Internet pollution problem and we’re not really sure how to fix it.” (33:14)
Ben (on his future):
"I kind of want to travel a little bit and see what's out there. I kind of want to take a little bit of a vacation too. You know, I think after all this." (33:58)
Jessica (on a Kim Wolf T-shirt):
“You gonna make a T shirt you didn’t get one out of... this particular endeavor...Maybe it says, I stopped Kim Wolf and all I got was this lousy T shirt.” (34:21)

Key Timestamps

00:05–02:04: Kim Wolf emerges as a threat; DDoS attack concern
04:11–09:06: Ben’s early interest in computers and hacking culture
10:40–13:37: Deep dive into residential proxy networks
15:05–16:49: Ben links many proxies to single shady company, IP Idea
16:49–19:12: Hacker contacts Ben about his proxy list—first Kim Wolf clue
21:47–22:35: Ben partners with Chris Formosa and Big Pipes
23:18–24:28: The attack traced to a digital picture frame
25:18–27:55: Ben’s honeypot uncovers Kim Wolf’s method
28:56–31:35: Notification of vendors; legal takedowns of Kim Wolf
33:14: The “Internet pollution” and what comes next
33:58–34:33: Ben’s future plans and the T-shirt joke

Conclusion

This episode captures how curiosity, technical skill, and ethical tenacity enabled one college student to shield the world’s internet infrastructure from catastrophic harm. It exposes the hidden danger of everyday connected devices and highlights the crucial—and unexpected—role individuals can play in global cybersecurity. Listeners are left with both a warning about “Internet pollution” and a sense of hope from Ben’s accidental heroism.

The College Student Who Defeated the World’s Biggest Cyberweapon

Podcast: The Journal
Hosts: Ryan Knutson & Jessica Mendoza
Episode Date: May 1, 2026

Overview:

Key Discussion Points & Insights

1. Introduction to Kim Wolf – The Unprecedented Botnet (00:05–02:04)

Kim Wolf was a fast-growing botnet that quietly hijacked nearly 2 million Android devices globally (00:38).
Its primary attack method: massive Distributed Denial of Service (DDoS) attacks coming from everyday devices—phones, cameras, TV boxes—rendering targets inaccessible by flooding them with junk data (01:04).
"The concern here was that they could knock out the Internet...the message was be afraid, be very afraid." — Bob McMillan, cybersecurity reporter (01:46).

2. Benjamin Brundage’s Unlikely Path (04:11–10:04)

Ben’s early life was not computer-focused; he preferred hiking and skiing (04:21), but the COVID lockdowns and a Minecraft obsession drew him into coding and ultimately, hacking culture.
His initial foray included building mods and cheats in Minecraft, sometimes getting accounts banned (06:16).
Online gamer chat rooms (Discord) exposed him to more serious hacking and cybercrime communities, leading to a moral crossroads.
- "If you spend all your time around these communities... things you would view as immoral or wrong start to become normalized." — Ben (07:37)
Ben once discovered a dump of stolen Spotify credentials and, disturbed, emailed the victims—a moment steering him toward ethical hacking (08:42).
His first bug bounties were with the Dutch government, earning only a T-shirt: “Hack the Dutch government and all I got was this lousy T shirt” (09:55).

3. The Shady World of Residential Proxies (10:40–13:37)

Ben’s curiosity shifted to “residential proxy networks”—services that let users “rent out” their home IP addresses, often unknowingly, via infected devices or dodgy apps.
These proxies are misused for a wide range of crime (11:43–12:07): from hacking and ticket scalping to nation-state attacks.
- Bob McMillan: “It’s basically any kind of crime you can think about that happens on the Internet. Happens with residential proxy networks.” (11:58)
Many devices are compromised via free streaming apps or IoT gadgets with malware preinstalled.

4. Ben’s Discovery: A Single Shady Company Behind Many Proxies (15:05–16:49)

Ben noted many residential proxy sites had identical layouts—one company, “IP Idea,” operated under dozens of names with virtually no security or regulation.
- “IP Idea had no regulations...they didn’t have guardrails to prevent their users from committing fraud. The fact that they didn’t stood out.” — Ben (15:51)

5. The Encounter with a Hacker & Realization of Kim Wolf (16:49–19:12)

Ben published a tool to detect if an IP was part of a res proxy network. A hacker messaged him, boasting Ben’s list missed many compromised IPs and dropping hints about an “operation” spending $30,000 a month in infrastructure (17:08–18:47).
- “This isn’t some rinky dink operation...don’t investigate us, essentially.” — Hacker (18:47)
Ben’s suspicions grew, realizing this was connected to the much bigger Kim Wolf botnet.

6. Joining the “Internet Wizards” – The Cybersecurity Team-Up (19:12–22:35)

Chris Formosa, engineer at network company Lumen, had also been investigating IP Idea. He and Ben connected and collaborated intensely (21:47–21:58).
- “Ben kind of figured almost all of it out just by himself, which is nothing short of amazing.” — Chris (21:47)
Chris introduced Ben to “Big Pipes”, a coalition of top cybersecurity experts from major companies, who embraced Ben’s insights.

7. The Breakthrough: Tracing the Attack to a Picture Frame (23:18–24:28)

The Big Pipes team noticed a DDoS attack coming from inside their own ranks: a $50 digital picture frame belonging to an employee (23:57).
- This device was unwittingly part of Kim Wolf's arsenal, showing how consumer IoT devices were weaponized.

8. Ben’s Honeypot Sets the Trap for Kim Wolf (25:18–28:56)

Ben set up an Android honeypot by installing suspicious IP Idea software from a pirated streaming site (25:53).
He detected a suspicious domain ("XD Resi to") accessing his device—evidence of the hacking mechanism (26:31–26:53).
The “tunnel” of a residential proxy was subverted: hackers used it to access and exploit local networks, not just to route external internet traffic (27:29–27:55).
- Bob McMillan: “Instead of going to another place on the Internet, the hackers were saying, take us to someplace on your local network...where we can get control of your whole phone or your whole picture frame...” (27:29)

9. The Fix & Takedown—Victory (28:56–32:29)

Ben and Big Pipes determined Kim Wolf exploited a bug in IP Idea’s software, allowing hijack of devices for DDoS attacks—without IP Idea’s knowledge.
Ben identified 2 million infected devices, affecting a dozen other proxy companies, and notified vendors (28:56).
Major action followed:
- Dec 17: Ben sends warnings post-finals (29:44).
- Jan: Google, via court order, seizes IP Idea domains and servers; 10 million compromised devices are revealed (30:09).
- March: DOJ seizes Kim Wolf’s infrastructure after 26,000 attacks (30:26). Ben and his company "Synthient" are credited by DOJ (31:35).
“Ben was the most important, critical MVP, whatever you want to call it.” — Chris Formosa (32:05)

10. The Internet’s Pollution Problem (33:01–34:15)

Despite Kim Wolf’s takedown, thousands of devices globally remain compromised.
- “The real takeaway here is that we have an Internet filled with junk—garbage devices, garbage apps... It’s like an Internet pollution problem.” — Bob McMillan (33:14)
Listeners are pointed to Bob’s guide on checking their networks for infected devices.

11. Ben’s Reflection & Next Steps (33:58–34:33)

“It’s a really cool feeling...it’s also like rewarding...spent all this time...there’s real world value to what I’m doing.” — Ben (31:35)
Ben plans to graduate, build his company, and—finally—take a break.

Notable Quotes & Moments

Bob McMillan (on the scale of Kim Wolf):
"The concern here was that they could knock out the Internet." (01:46)
Ben Brundage (on encountering cybercrime):
“Things you would view as immoral or wrong start to become normalized.” (07:37)
Chris Formosa (on Ben’s key role):
“Ben was the most important, critical MVP, whatever you want to call it.” (32:05)
Ben Brundage (on the accident of impact):
“This all was by, you know, accident, but it's...rewarding... there's an actual impact, or...real world value to what I'm doing.” (31:35)
Bob McMillan (on what’s next):
“We have an Internet pollution problem and we’re not really sure how to fix it.” (33:14)
Ben (on his future):
"I kind of want to travel a little bit and see what's out there. I kind of want to take a little bit of a vacation too. You know, I think after all this." (33:58)
Jessica (on a Kim Wolf T-shirt):
“You gonna make a T shirt you didn’t get one out of... this particular endeavor...Maybe it says, I stopped Kim Wolf and all I got was this lousy T shirt.” (34:21)

Key Timestamps

00:05–02:04: Kim Wolf emerges as a threat; DDoS attack concern
04:11–09:06: Ben’s early interest in computers and hacking culture
10:40–13:37: Deep dive into residential proxy networks
15:05–16:49: Ben links many proxies to single shady company, IP Idea
16:49–19:12: Hacker contacts Ben about his proxy list—first Kim Wolf clue
21:47–22:35: Ben partners with Chris Formosa and Big Pipes
23:18–24:28: The attack traced to a digital picture frame
25:18–27:55: Ben’s honeypot uncovers Kim Wolf’s method
28:56–31:35: Notification of vendors; legal takedowns of Kim Wolf
33:14: The “Internet pollution” and what comes next
33:58–34:33: Ben’s future plans and the T-shirt joke

wavePod

The College Student Who Defeated the World’s Biggest Cyberweapon

Summary

The College Student Who Defeated the World’s Biggest Cyberweapon

Overview:

Key Discussion Points & Insights

1. Introduction to Kim Wolf – The Unprecedented Botnet (00:05–02:04)

2. Benjamin Brundage’s Unlikely Path (04:11–10:04)

3. The Shady World of Residential Proxies (10:40–13:37)

4. Ben’s Discovery: A Single Shady Company Behind Many Proxies (15:05–16:49)

5. The Encounter with a Hacker & Realization of Kim Wolf (16:49–19:12)

6. Joining the “Internet Wizards” – The Cybersecurity Team-Up (19:12–22:35)

7. The Breakthrough: Tracing the Attack to a Picture Frame (23:18–24:28)

8. Ben’s Honeypot Sets the Trap for Kim Wolf (25:18–28:56)

9. The Fix & Takedown—Victory (28:56–32:29)

10. The Internet’s Pollution Problem (33:01–34:15)

11. Ben’s Reflection & Next Steps (33:58–34:33)

Notable Quotes & Moments

Key Timestamps

Conclusion

Transcript

Summary

The College Student Who Defeated the World’s Biggest Cyberweapon

Overview:

Key Discussion Points & Insights

1. Introduction to Kim Wolf – The Unprecedented Botnet (00:05–02:04)

2. Benjamin Brundage’s Unlikely Path (04:11–10:04)

3. The Shady World of Residential Proxies (10:40–13:37)

4. Ben’s Discovery: A Single Shady Company Behind Many Proxies (15:05–16:49)

5. The Encounter with a Hacker & Realization of Kim Wolf (16:49–19:12)

6. Joining the “Internet Wizards” – The Cybersecurity Team-Up (19:12–22:35)

7. The Breakthrough: Tracing the Attack to a Picture Frame (23:18–24:28)

8. Ben’s Honeypot Sets the Trap for Kim Wolf (25:18–28:56)

9. The Fix & Takedown—Victory (28:56–32:29)

10. The Internet’s Pollution Problem (33:01–34:15)

11. Ben’s Reflection & Next Steps (33:58–34:33)

Notable Quotes & Moments

Key Timestamps

Conclusion