The College Student Who Defeated the World’s Biggest Cyberweapon

Summary

The College Student Who Defeated the World’s Biggest Cyberweapon

Podcast: The Journal
Hosts: Ryan Knutson & Jessica Mendoza
Episode Date: May 1, 2026

---

Overview:

This episode of The Journal delves into the extraordinary story of Benjamin Brundage, a 22-year-old computer science student at RIT, who played a critical role in identifying and dismantling the world’s most extensive botnet cyberweapon—Kim Wolf. The episode explores how Ben, operating out of his dorm room, uncovered the network’s mechanisms, outwitted global hackers, and collaborated with elite cybersecurity experts to neutralize the threat.

The core themes are the vulnerability of consumer devices, the blurred boundaries of the "shady" internet, and how a curious college student tipped the balance in favor of the “Internet wizards” who keep the web safe.

---

Key Discussion Points & Insights

1. Introduction to Kim Wolf – The Unprecedented Botnet (00:05–02:04)

• Kim Wolf was a fast-growing botnet that quietly hijacked nearly 2 million Android devices globally (00:38).
• Its primary attack method: massive Distributed Denial of Service (DDoS) attacks coming from everyday devices—phones, cameras, TV boxes—rendering targets inaccessible by flooding them with junk data (01:04).
• "The concern here was that they could knock out the Internet...the message was be afraid, be very afraid." — Bob McMillan, cybersecurity reporter (01:46).

2. Benjamin Brundage’s Unlikely Path (04:11–10:04)

• Ben’s early life was not computer-focused; he preferred hiking and skiing (04:21), but the COVID lockdowns and a Minecraft obsession drew him into coding and ultimately, hacking culture.
• His initial foray included building mods and cheats in Minecraft, sometimes getting accounts banned (06:16).
• Online gamer chat rooms (Discord) exposed him to more serious hacking and cybercrime communities, leading to a moral crossroads.
  • "If you spend all your time around these communities... things you would view as immoral or wrong start to become normalized." — Ben (07:37)
• Ben once discovered a dump of stolen Spotify credentials and, disturbed, emailed the victims—a moment steering him toward ethical hacking (08:42).
• His first bug bounties were with the Dutch government, earning only a T-shirt: “Hack the Dutch government and all I got was this lousy T shirt” (09:55).

3. The Shady World of Residential Proxies (10:40–13:37)

• Ben’s curiosity shifted to “residential proxy networks”—services that let users “rent out” their home IP addresses, often unknowingly, via infected devices or dodgy apps.
• These proxies are misused for a wide range of crime (11:43–12:07): from hacking and ticket scalping to nation-state attacks.
  • Bob McMillan: “It’s basically any kind of crime you can think about that happens on the Internet. Happens with residential proxy networks.” (11:58)
• Many devices are compromised via free streaming apps or IoT gadgets with malware preinstalled.

4. Ben’s Discovery: A Single Shady Company Behind Many Proxies (15:05–16:49)

• Ben noted many residential proxy sites had identical layouts—one company, “IP Idea,” operated under dozens of names with virtually no security or regulation.
  • “IP Idea had no regulations...they didn’t have guardrails to prevent their users from committing fraud. The fact that they didn’t stood out.” — Ben (15:51)

5. The Encounter with a Hacker & Realization of Kim Wolf (16:49–19:12)

• Ben published a tool to detect if an IP was part of a res proxy network. A hacker messaged him, boasting Ben’s list missed many compromised IPs and dropping hints about an “operation” spending $30,000 a month in infrastructure (17:08–18:47).
  • “This isn’t some rinky dink operation...don’t investigate us, essentially.” — Hacker (18:47)
• Ben’s suspicions grew, realizing this was connected to the much bigger Kim Wolf botnet.

6. Joining the “Internet Wizards” – The Cybersecurity Team-Up (19:12–22:35)

• Chris Formosa, engineer at network company Lumen, had also been investigating IP Idea. He and Ben connected and collaborated intensely (21:47–21:58).
  • “Ben kind of figured almost all of it out just by himself, which is nothing short of amazing.” — Chris (21:47)
• Chris introduced Ben to “Big Pipes”, a coalition of top cybersecurity experts from major companies, who embraced Ben’s insights.

7. The Breakthrough: Tracing the Attack to a Picture Frame (23:18–24:28)

• The Big Pipes team noticed a DDoS attack coming from inside their own ranks: a $50 digital picture frame belonging to an employee (23:57).
  • This device was unwittingly part of Kim Wolf's arsenal, showing how consumer IoT devices were weaponized.

8. Ben’s Honeypot Sets the Trap for Kim Wolf (25:18–28:56)

• Ben set up an Android honeypot by installing suspicious IP Idea software from a pirated streaming site (25:53).
• He detected a suspicious domain ("XD Resi to") accessing his device—evidence of the hacking mechanism (26:31–26:53).
• The “tunnel” of a residential proxy was subverted: hackers used it to access and exploit local networks, not just to route external internet traffic (27:29–27:55).
  • Bob McMillan: “Instead of going to another place on the Internet, the hackers were saying, take us to someplace on your local network...where we can get control of your whole phone or your whole picture frame...” (27:29)

9. The Fix & Takedown—Victory (28:56–32:29)

• Ben and Big Pipes determined Kim Wolf exploited a bug in IP Idea’s software, allowing hijack of devices for DDoS attacks—without IP Idea’s knowledge.
• Ben identified 2 million infected devices, affecting a dozen other proxy companies, and notified vendors (28:56).
• Major action followed:
  • Dec 17: Ben sends warnings post-finals (29:44).
  • Jan: Google, via court order, seizes IP Idea domains and servers; 10 million compromised devices are revealed (30:09).
  • March: DOJ seizes Kim Wolf’s infrastructure after 26,000 attacks (30:26). Ben and his company "Synthient" are credited by DOJ (31:35).
• “Ben was the most important, critical MVP, whatever you want to call it.” — Chris Formosa (32:05)

10. The Internet’s Pollution Problem (33:01–34:15)

• Despite Kim Wolf’s takedown, thousands of devices globally remain compromised.
  • “The real takeaway here is that we have an Internet filled with junk—garbage devices, garbage apps... It’s like an Internet pollution problem.” — Bob McMillan (33:14)
• Listeners are pointed to Bob’s guide on checking their networks for infected devices.

11. Ben’s Reflection & Next Steps (33:58–34:33)

• “It’s a really cool feeling...it’s also like rewarding...spent all this time...there’s real world value to what I’m doing.” — Ben (31:35)
• Ben plans to graduate, build his company, and—finally—take a break.

---

Notable Quotes & Moments

• Bob McMillan (on the scale of Kim Wolf):
  "The concern here was that they could knock out the Internet." (01:46)
• Ben Brundage (on encountering cybercrime):
  “Things you would view as immoral or wrong start to become normalized.” (07:37)
• Chris Formosa (on Ben’s key role):
  “Ben was the most important, critical MVP, whatever you want to call it.” (32:05)
• Ben Brundage (on the accident of impact):
  “This all was by, you know, accident, but it's...rewarding... there's an actual impact, or...real world value to what I'm doing.” (31:35)
• Bob McMillan (on what’s next):
  “We have an Internet pollution problem and we’re not really sure how to fix it.” (33:14)
• Ben (on his future):
  "I kind of want to travel a little bit and see what's out there. I kind of want to take a little bit of a vacation too. You know, I think after all this." (33:58)
• Jessica (on a Kim Wolf T-shirt):
  “You gonna make a T shirt you didn’t get one out of... this particular endeavor...Maybe it says, I stopped Kim Wolf and all I got was this lousy T shirt.” (34:21)

---

Key Timestamps

• 00:05–02:04: Kim Wolf emerges as a threat; DDoS attack concern
• 04:11–09:06: Ben’s early interest in computers and hacking culture
• 10:40–13:37: Deep dive into residential proxy networks
• 15:05–16:49: Ben links many proxies to single shady company, IP Idea
• 16:49–19:12: Hacker contacts Ben about his proxy list—first Kim Wolf clue
• 21:47–22:35: Ben partners with Chris Formosa and Big Pipes
• 23:18–24:28: The attack traced to a digital picture frame
• 25:18–27:55: Ben’s honeypot uncovers Kim Wolf’s method
• 28:56–31:35: Notification of vendors; legal takedowns of Kim Wolf
• 33:14: The “Internet pollution” and what comes next
• 33:58–34:33: Ben’s future plans and the T-shirt joke

---

Conclusion

This episode captures how curiosity, technical skill, and ethical tenacity enabled one college student to shield the world’s internet infrastructure from catastrophic harm. It exposes the hidden danger of everyday connected devices and highlights the crucial—and unexpected—role individuals can play in global cybersecurity. Listeners are left with both a warning about “Internet pollution” and a sense of hope from Ben’s accidental heroism.

Transcript

[A]

When a big cybersecurity threat emerges, the people in charge of taking it down are the engineers and network operators who keep the Internet running.

[B]

I think of them as wizards, the wizards of the Internet.

[A]

That's our colleague Bob McMillan, who covers cybersecurity, and he says that over the last year, the wizards of the Internet faced something at a scale they had never encountered before. It. It was called kimwolf.

[C]

Kimwolf.

[A]

Kimwolf.

[C]

A fast growing botnet called Kimwolf.

[A]

One of the most extreme botnet operations ever observed.

[C]

What makes Kim Wolf different is how

[A]

it spreads, quietly hijacking nearly 2 million Android devices across the globe. The scale alone is staggering. What the Internet wizards saw was a somewhat familiar threat. A network of bots engaging in distributed denial of service attacks.

[B]

So DDoS attacks are basically when you get a bunch of computers and they flood another computer with just like, junk data, like, hey, could you send me this webpage? And that junk data eventually slows down the computer to the point where it doesn't work. They sort of flood the zone with Internet traffic, and then the target doesn't work anymore.

[A]

But Kim Wolf's attacks were strange because they were coming from millions of devices, products connected to the Internet, like phones, cameras, and TV boxes. In effect, Kim Wolf seemed to be turning those everyday devices into a massive cyber weapon, the biggest one ever seen.

[B]

The concern here was that they could knock out the Internet. That was the concern, like the Internet could get wiped out with this phenomenon. The message was be afraid, be very afraid.

[A]

The wizards of the Internet faced a lot of unknowns about who was behind Kim Wolf and how they were able to infiltrate so many devices around the world. But in order to actually take Kim Wolf down, the wizards needed help from an unlikely ally.

[C]

So my name is Ben. I'm currently studying computer science over in upstate New York at Rochester Institute of Technology.

[A]

Benjamin Brundage is a 22 year old college senior. Over the course of a few months, Ben would come to play a critical role in figuring out how to stop Kim Wolf. And he did it all from his dorm room. Welcome to the Journal, our show about money, business and power. I'm Jessica Mendoza. It's Friday, May 1st. Coming up on the show, the college students who took on the world's biggest cyberweapon.

[C]

Study and play. Come together on a Windows 11 PC. And for a limited time, college students

[A]

get the best of both worlds.

[C]

Get the unreal college deal. Everything you need to study and play with select Windows 11 PCs. Eligible students get a year of Microsoft 365 Premium and a year of Xbox game pass ultimate with a custom color Xbox wireless controller. Learn [e-mail] studentoffer while supplies last ends June 30th. Terms at aka mscollegepc.

[A]

Morning decisions. How about a creamy mocha frappuccino drink? Or sweet vanilla smooth caramel maybe? Or white chocolate mocha? Whichever you choose, delicious coffee awaits. Find Starbucks Frappuccino drinks wherever you buy your groceries. Years before Kim Wolf was discovered, Benjamin Brundage lived the typical life of a high school student. How would your friends describe you?

[C]

Um, I think it probably ranges, but I think maybe hardworking, passionate, sometimes lazy too, I guess a mix of things for sure.

[A]

Who isn't? When we spoke, Ben was in a white T shirt, which set off his bright red hair. He grew up in Washington State. His parents work in tech, but as a kid, he never caught the bug for computers. Instead, Ben preferred hiking and skiing rather than staring at screens. But that changed when Ben was 16 years old in 2020.

[C]

You know, I was playing a lot of online video games for like way too long, especially, especially during COVID And I started to kind of find Minecraft super interesting.

[A]

Minecraft, the open world game where players use pixelated blocks to build whatever they want. Mine in caves and yes, fight exploding enemies called creepers. But what Ben found most interesting was the code behind the game.

[C]

You can build stuff in Minecraft with this programming language and add on functions functionality that you normally wouldn't get. And so to me, that was like super cool and kind of drove, I think, a lot of that initial interest where, you know, I'd stay up super late, like watching Java tutorials. How do you build a Minecraft mod?

[A]

Ben discovered godlike powers in Minecraft, using code to create entirely new plants and creatures.

[C]

And so it was kind of like, I think to me, like, largely like, wow, like, you know, there's so much imagination that I can kind of just put into this real world. It's a really, I don't know how to describe the feeling, but really rewarding feeling where you can take your ideas and you can, you know, see them in fruition. To me, that was super cool.

[A]

Ben didn't just find creative ways to modify the game. He also found ways to cheat.

[C]

There's like a degree of like, how do you get an advantage in these games? Right. I think when you're 16 years old, it's very appealing because suddenly you have an advantage over most other people.

[A]

Ben made cheats that allowed him to see through walls and automatically aim at Enemies. His Minecraft account was actually banned from some servers. Ben started talking about cheats with other players on Discord, a messaging app popular with gamers. And it's through those communities that Ben was introduced to another side of programming. Ben was entering the world of hacking. On Discord, Ben met people who were openly talking about cybercrime.

[C]

I started out with Minecraft, but maybe a few servers over, you're entering reverse engineering, you're maybe finding a server related to malware. It's all like very interconnected and it's very easy to kind of be exposed to it because, you know, you meet friends with people, they're like, oh, join here. Or they want to show you something. And as a result, it kind of spirals.

[A]

You know, looking at all this stuff, you know, I'm imagining you as a 16 year old. You're clearly a curious guy. Did you ever think of going along with the crowd and becoming a hacker too?

[C]

I think it's one of those things where people don't really, like, think about it. Like, I definitely push boundaries I should not have in, like, hindsight. But I think the issue is like this normalization where if you spend all these, you know, all your time around these communities, things stop becoming the things that you would view as immoral or wrong, start to become normalized. You know, spending a year, maybe that community, it's like, oh, you know, who cares, right? Like, it's just.

[A]

It's just what people do.

[C]

Exactly. Right?

[A]

Were you ever shocked by anything you saw that other people were doing on these servers?

[C]

There was one thing that really stood out to me, I think when I was like 16 years old. But somebody had shared like this list of credentials for Spotify Premium, where it was a bunch of people stolen accounts. It was like 100 email and passwords.

[A]

A Spotify spokesperson encourages users to use strong, unique passwords to help keep accounts secure. By the way, this podcast is a co production with Spotify, so please don't steal Spotify Premium.

[C]

I remember seeing this and thinking to myself, oh, my God. I mean, this is pretty egregious. And so I think I had emailed like all 100 people or 60 people on that list, like notifying them, hey, your account was compromised with shared.

[A]

Ben saw that he was at a fork in the road. He could stay on the right side of the law or he could follow in the footsteps of hackers.

[C]

This wasn't going to lead down any good roads, right? Like, the people that are committing these crimes, maybe they get arrested. Maybe you see it right it's something where I was like, okay, something has to change here.

[A]

Instead of cybercrime, Ben turned to cybersecurity. An early opportunity to use his skills for good came in his senior year of high school. The Dutch government was inviting hackers from all over the world to look for vulnerabilities on its websites. And the reward for finding a bug was a T shirt. Ben decided to give it a go, and he found not one, but two major bugs.

[C]

And so, like, I had reached out over email. I was like, hey, I found both of these vulnerabilities, and I think it was a couple months before I even heard back, but they were like, oh, you know, what size T shirt do you want? Do you want.

[A]

What does it say?

[C]

Oh, it's fully black and then has white text. And then the text says, hack the Dutch government. And all I got was this lousy T shirt.

[A]

It may have been a lousy T shirt, but Ben says it was a dopamine rush. Over the next few years, he kept on learning. He moved to upstate New York to study computer science, and he learned all sorts of things, like how to automate tasks and build bots. And while Ben didn't know it, that path was leading him straight to a massive cyberweapon, because Ben was about to encounter the obscure piece of Internet tech that powered Kim Wolf. They're called residential proxy networks. Here's our colleague Bob again.

[B]

Residential proxy is really a way of just masquerading as somebody else, okay? On the Internet, we all have something that's like the equivalent of our phone number. It's called an IP address. And these IP addresses basically are good indicators of who's visiting your websites. What residential proxy does is it basically lets you Airbnb that IP address.

[A]

Once your IP address is rented out, Internet traffic is then routed through your network for a small fee.

[B]

So you might actually get paid to allow somebody to go from your IP address to anywhere on the Internet.

[A]

Residential proxies, or res proxies, as they're sometimes known, are really useful, and not just for users who want to be anonymous online, but also for programmers who build bots that, for example, scrape web data. But they also occupy a somewhat shady side of the Internet. For one, res proxies can be used

[B]

to hide crimes, any kind of online criminal activity. This could be, like, nation states hacking into corporations. This could be ticket scalpers trying to buy a bunch of tickets, you know, identity fraud.

[A]

Wow.

[B]

So it's basically any kind of crime you can think about that happens on the Internet. Happens with residential proxy networks.

[A]

The companies behind res proxies can also be shady because they don't always source IP addresses. Ethically, some res proxy companies get IPs by sneaking malicious software onto your devices.

[B]

There's software you can download that will put you on a residential proxy network without your knowledge or consent. There's a lot of. And there, there are devices you can buy that will also do that.

[A]

What do you mean? What kinds of apps or devices?

[B]

One place you need to be wary in is if you're downloading an app or buying a device that's going to let you watch content for free that you're supposed to be paying for, there's a decent chance that's going to put you on a residential proxy network. Like that's a very common way. Yeah, it's nothing truly free. Yeah, yeah. There's a reason why the you're getting something that seems too good to be true.

[A]

Other devices, like Internet connected appliances can come with res proxy malware pre installed.

[C]

It was like a crazy thing to start to realize that a lot of these IP addresses are in fact unethically obtained.

[A]

Between classes, Ben Brundage used his free time to learn everything he could about residential proxies.

[C]

To me, it was just like, oh, I feel like there's something more here. Like it was just, you know, I feel like people should talk about it more. It seems interesting. There's a whole world here that people rarely touch on.

[A]

So from his dorm room, Ben started exploring that shady world. But what Ben didn't realize was that underneath that world, there lived a monster. That's after the break foreign. This episode is brought to you by Atlassian Rovo, the AI that takes your team from AI novice to AI native. Using AI shouldn't feel like extra work. Rovo works inside the tools you use already, like Jira and Confluence. It takes care of status updates, backlog cleanup and repetitive tasks for you. So you can focus on what actually moves work forward. Try Rovo from [e-mail]. After he got interested in residential proxies, Ben decided to analyze the IP addresses that made up their networks. He started keeping track of the suspicious IP addresses in a list, information he thought could be valuable. By August of last year, Ben had created his own one man company called Synthient. But as he cataloged IP addresses, Ben noticed something stranger still. The websites for a lot of the rez proxy providers were eerily similar.

[C]

I was like, okay, these are exactly the same, right? They have a cookie cutter website where checkout flow is the same. The website user interface is the same. The only thing that's different is the brand name and, you know, the color palette, maybe.

[A]

As it turns out, behind those nearly identical websites was just one res proxy company called IP Idea. Ben couldn't find much about IP Idea. The company didn't list a chief executive or a founder on its website. It didn't post an address, and actually, it appeared to operate under more than a dozen names. But what especially piqued Ben's curiosity was that IP Idea didn't have much in terms of security.

[C]

IP Idea had no regulations. And so it's just like, oh, that's really interesting, right. Like, most of these proxy providers, they have stuff in place that are like guardrails to prevent their users from committing fraud, let's say. Right. And the fact that they didn't stood out.

[A]

IP Idea didn't respond to requests for comment, but a spokeswoman said earlier this year that the company always explicitly opposed illegal or abusive conduct on its network. Ben decided to focus his research on IP Idea. By the start of his senior year in college, he had mapped out a huge chunk of the company's network of IP addresses. Then Ben showed off his work online. He built an online tool that would let someone see if their IP address was on his list, and he shared it on Discord. A week later, Ben got a message from a mysterious user. The user told Ben that he hadn't caught everything.

[C]

They were like, okay, you're missing some IP addresses. And they send some screenshots of essentially their residential proxies not being detected by the service. So they're like, oh, you got a couple of them, but you didn't get all of them. Essentially,

[A]

The mysterious user appeared to be a hacker, someone who was part of an operation that exploited devices on IP Idea to build a network of bots.

[C]

They were definitely gloating.

[A]

They also appeared to be selling access to their botnet for a fee. Other hackers could use the botnet for attacks. Cybercrime as a service. Ben says he could tell this person was young.

[C]

I think there's, like, a certain way of typing that people my age tend to type in, let's say on Discord or any social media where they maybe use emojis more often or GIFs or even the language they use. So I think that was kind of the indicator that it's not gonna be somebody that's in their 40s or 30s, you know what I mean? It's somebody probably around my age or younger.

[A]

Ben kept talking to the hacker he wanted to learn more, but he didn't want to come off too strongly, so he made jokes to keep things chill.

[C]

And so I was like, okay, I'll just be unserious here and see kind of where it goes. And so I sent this cat gif, which was like, you know, this cat essentially with a tuxedo on, you know, looking super professional. And like, that was my way of saying that, you know, like, I'm not really that professional. Right.

[A]

The cat meme worked. It lightened the mood, and the hacker started sharing more details with Ben.

[C]

He was able to obtain all these compromised devices using an unknown method.

[D]

Right.

[C]

And, like, these things stood out to me at the time because I was like, huh, I wonder what's actually going on here?

[A]

The hacker also told Ben that the operation was huge.

[C]

He told me that they were spending like 30,000amonth on infrastructure. Like, that was an insane amount of money. He also told me, he's like, this isn't some rinky dink operation. Right. And there was another comment which was like, don't investigate us, essentially. Right. I think all three of those comments were like, okay, that's kind of suspicious. Something way bigger is going on here.

[A]

The something way bigger was Kim Wolf. Ben had stumbled onto a dangerous botnet that had been launching massive DDoS attacks designed to knock websites offline with floods of junk data. One attack was so large that it was as if everyone in Germany, Spain and the United Kingdom had gone to the same website at the exact same second. Cybersecurity experts had been studying this botnet for months. One of those experts was an engineer at a networking company called Lumen. So not to be confused with the company from the show Severance, right?

[D]

Not to be confused with it, yes. Although it did increase our popularity.

[A]

At Lumen, Chris Formosa had been researching the threat that residential proxy networks could pose to Internet infrastructure. And a lot of his work focused on one Res proxy company in particular, IP Idea. That's where the botnet attacks seemed to be coming from.

[D]

The main thing we were interested in, how do we deal with this giant botnet we were seeing it was growing at kind of an unchecked pace, and a botnet of that scale can do a lot of extreme damage. So one of the challenges we were facing is we didn't know how they were gathering these victims,

[A]

but something didn't add up. While residential proxies enable plenty of crimes, companies like IP Idea generally discourage DDoS attacks like the one Kim Wolf was engaging in. That's because when devices participate in DDoS attacks, their IP addresses generally get blacklisted by websites across the Internet, making them useless. That's bad business if you're trying to rent out IP addresses. Kimwolf seemed to be using IP Idea's network, but it wasn't clear how.

[D]

The worry is that these networks have millions and millions of IPs and they don't often have security teams or kind of anybody checking what activity is happening. So if somebody finds a way to harness these millions of devices, they can use them to do really malicious activity like a large scale DDoS attacks.

[A]

To find out what was going on, Chris needed to learn more about IP Idea. The problem was that only a handful of people on the planet knew much about the company. But then a fellow cybersecurity researcher told Chris there was someone he should meet. You connected with Ben Brundage. What was your first impression of him?

[D]

Yeah, I can't say enough about Ben. Ben kind of figured almost all of it out just by himself, which is nothing short of amazing. The first day we chatted for probably like eight hours straight, just passing notes.

[A]

Back in eight hours?

[D]

Yeah, it was just back and forth, just throwing notes to each other and just, we couldn't stop. It was just so much fun.

[A]

For the next month, Ben and Chris worked together, sharing notes about IP Idea. Some of what Ben shared came from the conversations he'd had on Discord with that mysterious hacker. And after analyzing the IP addresses Ben had cataloged, Chris realized that the hacker was likely connected to Kim Wolf. Soon after they met, Chris introduced Ben to a group that was working on the kimwolf mystery. A group called Big Pipes.

[D]

Big Pipes is an incredible group of people who really just want to make the world a lot better.

[A]

Big Pipes is a cybersecurity working group made up of Internet wizards from major Internet companies. Soon, Ben was joining Big Pipes weekly conference call, sharing what he knew.

[C]

You know, to me it was like those crazy feelings because, you know, I'm just some college kid that like, had found this by accident. But then it's like, oh, you know, it's actually contributing to something bigger was like this really rewarding feeling.

[A]

It wasn't long after Ben started working with Big Pipes that the group would run into a breakthrough moment when one of their own was hit by a kimwolf attack. Here's our colleague Bob again.

[B]

One of the companies in Big Pipes was looking at the traffic that was hitting their network, and they realized that one of their own employees, like the IP address of one of their own employees, was launching the Attack. So they reached out to that employee and they said, could you do some technical stuff on the network and see what is going on?

[A]

That employee looked through their home network trying to find the culprit. And what they found was surprising. One of the devices firing off junk Data was a $50 digital picture frame, the kind you can update with photos from your phone. I actually got my grandma one of those.

[B]

And so that gave them something to look at. Right. So they look at this device and they start trying to figure out why it's doing it, and they realize that something in this device was also allowing it to be part of Kim Wolf.

[A]

Hmm.

[B]

Then it sort of pointed to, like, are these devices somehow being hacked? That was like the question to get onto the kimwolf network.

[A]

How Ben figured that out is next. A digital picture frame belonging to a big Pipes employee had become part of Kim Wolf. But it still wasn't clear how hackers were manipulating the device. Ben and Chris scoured the Internet for clues. And Ben kept thinking about what that mysterious hacker had told him.

[C]

I was definitely trying to figure out how everything was being done right. Like, they claim they had this novel exploit. How were they actually achieving it? Right. And so I was trying to figure out these kind of loose strands and unravel the mystery, I guess.

[A]

Ben wanted to see exactly how Kim Wolf could break into devices on IP Idea's network to build its cyber weapon. So he decided to set a trap, a honeypot that would lure in Kim Wolf. Here's Chris Formosa again.

[D]

I'd say Ben's honeypot is the gold mine that was the key. So the idea was there's gotta be. We think they're exploiting residential proxy devices. So the best way to figure out if that's true is make yourself a honeypot and become one.

[A]

Here's how Ben set up the trap.

[C]

I had this Android phone that I'd used for reverse engineering.

[A]

As one does.

[C]

Yeah, exactly as one does.

[A]

Ben installed IP Idea's software onto that Android phone, downloading it from a website that offered pirated streaming apps. Then he built a setup that allowed him to monitor the Internet traffic coming to and from that Android. Then he waited. In the meantime, Ben studied for his midterm exams.

[C]

I was so stressed during this time, but I think I had set up this tracking. I had this running for a week, and I saw this domain keep popping

[A]

up called XD Resi to XD Resy to a strange web address that didn't seem to belong to IP Idea.

[C]

And to me, that really Stood out. I was like, oh, that's really interesting. I wonder what's going on here? And it turns out that this was what they were using for their initial access or compromising the devices.

[A]

Kim Wolfhackers had set up that domain to gain access to devices on IP Idea's network. It was a direct link between the hackers and Ben's Android. And once they were in, Ben saw that kimwolf started doing something really unusual. Normally, residential proxies act like a tunnel between a user and whatever place on the Internet they're trying to connect to. There are no stops or pauses. But Ben noticed that the traffic from that weird domain was somehow sticking around. Here's Bob.

[B]

Instead of going to another place on the Internet, the hackers were saying, take us to someplace on your local network. Take us to this part of your phone where we can get control of your whole phone or your whole picture frame or your whole streaming device. They were only supposed to be using the residential proxy to visit the Internet, not to visit local networks.

[A]

It's like if an Airbnb guest decided to squat in their rental and rummage through all the locked closets and drawers looking for stuff to steal. Ben took his findings back to the rest of Big Pipes, and together they discovered a bug in IPID as code, a bug that Kim Wolf hackers exploited to break into home networks and look for vulnerable devices. The hackers would then install software onto those devices that allowed them to engage in DDoS attacks. What Ben's honeypot also revealed is that IP Idea and Kim Wolf weren't working together. Kimwolf was paying for access to IP Idea's network and abusing it to hack into consumer devices.

[C]

And so it's like, oh, you know, I kind of understand how they're doing it now. I understand how easy it is. And then I think it was also, a bit, like, scary, right? Like, you can see all these domains and what people are sending requests to, and you see this one domain that's just the very, like, top here. And it just means that they're compromising just devices at an unseen scale.

[A]

Before, Ben had solved the mystery. Eventually, Ben identified around 2 million devices. Things like TV boxes, phones, cameras, picture frames, all hacked by Kim Wolf. Ben also found that IP Idea wasn't the only residential proxy company that was vulnerable to the bug. Ten other companies were, too. The next step was to warn the world. Ben started writing notices to rez proxy companies, including IP Idea, to tell them about the bug and how to fix it. And at this point, you Know where, where are we at in the school year? What's happening to your college work?

[C]

I think I. This was 20 towards the end of finals. Even though I'm not like the best student, there's definitely a degree of like,

[A]

you know, I have parents, I have guests.

[C]

Exactly. I have parents that love me. And so like I have to do these things because otherwise, you know, they give me a bit of grief for it, you know, I love.

[A]

You're also so close to graduating, so, you know.

[C]

Exactly.

[A]

Might as well keep going.

[C]

Exactly right. So I was just trying to wrap everything up.

[A]

One Internet wizard told Bob that if Ben's spent too much time studying for his finals, the Internet might actually break. On December 17, the day after his last test, Ben sent out the notices. Nine days later, IP Idea finally replied, apologizing. They told Ben that his email had gone to spam, but they said they were fixing the problem. But IP Idea's fix came too little, too late. In January, Google used a US court order to strike at IP Idea, taking down 13 of the company's business domains and shutting down dozens of IP Idea servers. Google had identified more than 10 million devices that came with IP Idea's software secretly pre installed. Two months later, in March, the Department of justice took action against four of the world's largest DDoS botnets, including Kimwolf, by seizing Internet domains, virtual servers and other network infrastructure. According to court filings, Kimwolf had launched more than 26,000 DDoS attacks, targeting over 8,000 victims. At the end of its press release, the DOJ thanked several companies for their help in the Kimwolf operation. They included Google, Lumen and Synthient, Ben's company.

[C]

It's a really cool feeling like if I being like 100% honest, like this all was by, you know, accident, but it's also like rewarding in the sense of like, you know, I spent all this time on here, spent, you know, maybe even sacrifice time from other things I should be giving it to, whether that's school or friends. And so it's cool to kind of see that like there's an actual impact or, you know, real world value to what I'm doing, I guess.

[A]

In the case of Kim Wolf, how important was Ben for that investigation?

[D]

Ben was the most important, critical mvp, whatever you want to call it.

[A]

That's Chris Formosa again, the Lumen engineer.

[D]

Ben really kind of figured out who the main actors were, who was likely running it, how they were doing it, how the exploitation worked. Ben was kind of the key information piece around everything

[B]

the people in big pipes, they would have eventually figured this out, but they sure got a lot of help from Ben, Bob McMillan. Again, like the big pipes people, they were the wizards who see the flows of data on the Internet and they can see that. They could see, pick up the software that's being, you know, downloaded, and they can see the IP addresses of everything. But they weren't on discord discussion groups sharing cat memes. Right. That's not how they worked.

[A]

These days, kimwolf is a shadow of its former self, but cybersecurity experts say it is still around, lurking in thousands of vulnerable devices. And Bob says there are a lot of those out there.

[B]

The real takeaway here is that we have an Internet filled with junk. We have garbage devices, garbage apps that are doing a lot of bad stuff, and they've become part of the criminal infrastructure. It's like an Internet pollution problem. That's the takeaway, is that we have an Internet pollution problem and we're not really sure how to fix it.

[A]

By the way, if you want to see if there's a secret residential proxy device on your network. Bob wrote a quick guide on how to check. The link is in the show notes. As for Ben, he says he's now focused on graduating and on building his startup. And he also wants to take a break.

[C]

I kind of want to travel a little bit and see what's out there. I kind of want to take a little bit of a vacation too. You know, I think after all this.

[A]

So, yeah, you deserve that. You gonna make a T shirt you didn't get one out of. Out of this particular endeavor? Maybe you can make one for yourself.

[C]

I've heard there's one on the way, so fingers crossed.

[A]

Oh, is that right?

[C]

That's what I've heard. We'll see, though.

[A]

Do you know what it'll say?

[C]

I have no clue. Maybe it says, I stopped Kim Wolf and all I got was this lousy T shirt.

[A]

That's all for today. Friday, May 1. The Journal is a co production of Spotify and the Wall Street Journal. This episode was produced by Enrique Perez de la Rosa and edited by Colin McNulty. The show's made by Kathryn Brewer, Pia Gidkari, Sophie Kodner, Ryan Knudsen, Matt Kwong, Laura Morris, Sarah Platt, Allen Rodriguez Espinosa, Heather Rogers, Piers Singhi, Jeeva Kaverma, Kathryn Whelan, Tatiana Zemis and me, Jessica Mendoza. Our engineers are Griffin Tanner, Nathan Singapak and Peter Leonard. Our theme music is by so Wiley. Additional music this week from Katherine Anderson Peter Leonard, Billy Libby, Nathan Singapak and Griffin Tanner. Fact checking this week by Kate Gallagher and Mary Mathis. Thanks for listening. See you on Monday. Hey, Mama. Thanks for making all my favorite recipes.

[C]

Hi, Ma. Thanks for your unfiltered advice.

[A]

Hi, Mom. Thanks for always being by the phone.

[B]

Hey, Mom. Happy Mother's Day.

[A]

When you ship UPS Air at the UPS Store, your items arrive on time or your money back. Guaranteed at no extra cost. Exclusively at the UPS store US retail locations. Visit the upsstore.com airshipping for full details. Terms and conditions apply. Send your Mother's Day gifts at the UPS Store and we'll get your gratitude there on time.