The Journal. - The College Student Who Defeated the World’s Biggest Cyberweapon

Episode Date: May 1, 2026

Last year, a massive cyberweapon terrorized the internet. It launched thousands of DDoS attacks, threatening tens of millions of people around the world. The weapon came to be known as Kimwolf. WSJ’s Robert McMillan reports that cybersecurity experts were stumped. Kimwolf’s attacks seemed to be launched from millions of internet-connected devices like TV boxes, cameras and picture frames. Eventually, the experts got help from an unlikely ally: a 22-year-old college senior named Benjamin Brundage. Jessica Mendoza talks to Ben about how he might have saved the internet. To check if your network is secretly connected to a residential proxy network, here are a few tips. Further Listening: - Cybersecurity Braces for AI ‘Bugmaggedon’ - ‘Hack Me If You Can’ from The Journal Sign up for WSJ’s free What’s News newsletter. Learn more about your ad choices. Visit megaphone.fm/adchoices

When a big cybersecurity threat emerges, the people in charge of taking it down are the engineers and network operators who keep the internet running. I think of them as wizards. The wizards of the internet. That's our colleague Bob McMillan, who covers cybersecurity. And he says that over the last year, the wizards of the internet faced something at a scale they had never encountered before. It was called Kim Wolf. Kim Wolf. Kim Wolf. A fast-growing botnet called Kim Wolf.

One of the most extreme botnet operations ever observed. What makes Kim Wolf different is how it spreads. Quietly hijacking nearly 2 million Android devices across the globe. The scale alone is staggering. What the internet wizard saw was a somewhat familiar threat, a network of bots engaging in distributed denial of service attacks. So DDoS attacks are basically when you get a bunch of computers and they flood another computer with just like junk data. Like, hey, could you send me this web page?

And that junk data eventually slows down the computer to the point where it doesn't work. They sort of flood the zone with internet traffic and then the target doesn't work anymore. But Kim Wolf's attacks were strange because they were coming from millions of devices. Products connected to the internet like phones, cameras and TV. boxes. In effect, Kim Wolf seemed to be turning those everyday devices into a massive cyber weapon, the biggest one ever seen. The concern here was that they could knock out the internet. That was the concern. Like the internet could get wiped out with this phenomenon. The message was, be afraid. Be very afraid. The wizards of the internet faced a lot of unknowns about who,

was behind Kim Wolf and how they were able to infiltrate so many devices around the world. But in order to actually take Kim Wolf down, the wizards needed help from an unlikely ally. So my name is Ben. I'm currently studying computer science over in upstate New York at Rochester Institute of Technology. Benjamin Brendidge is a 22-year-old college senior. Over the course of a few months, Ben would come to play a critical role in figuring out how to stop Kim Wolf. And he did it all from his dorm room. Welcome to The Journal, our show about money, business, and power. I'm Jessica Mendoza. It's Friday, May 1st. Coming up on the show, the college student who took on the world's biggest cyber weapon. This episode is brought to you by IG Private Wealth.

When your financial life gets more complex, having a clear plan matters. IG advisors build personalized, integrated financial plans that connect. your investments, tax strategies, retirement income, and estate planning into one coordinated plan. They will help you make confident decisions about your wealth and your future. Get financial advice that puts you at the center. Visit IGPrivatewealth.com to find an advisor near you. Years before Kim Wolf was discovered, Benjamin Brundage lived the typical life of a high school student. How would your friends describe you?

I think it probably ranges, but I think maybe hard work. working, passionate, sometimes lazy too, I guess, a mix of things for sure. Who isn't? When we spoke, Ben was in a white t-shirt, which set off his bright red hair. He grew up in Washington State. His parents work in tech, but as a kid, he never caught the bug for computers. Instead, Ben preferred hiking and skiing rather than staring at screens. But that changed when Ben was 16 years old in 2020.

You know, I was playing a lot of online video games for like way too long, especially during like COVID. And I started to kind of find like Minecraft super interesting. Minecraft. The open world game where players use pixelated blocks to build whatever they want, mine and caves. And yes, fight exploding enemies called creepers. But what Ben found most interesting was the code behind the game. You can build stuff in Minecraft with this programming language and add-on functionality that you normally wouldn't get. And so to me, that was like super cool and kind of drove, I think, a lot of that initial interest,

where, you know, I stay up super late, like watching Java tutorials, how do you build a Minecraft mod? Ben discovered godlike powers in Minecraft, using code to create entirely new plants and creatures. And so it was kind of like, I think to me, like largely like, like, wow, like, you know, there's so much imagination that I can kind of just put it into this real world. It's a really, I don't know how to describe the feeling, but really rewarding feeling where you can take your ideas and you can, you know, see them in fruition.

To me, that was super cool. Ben didn't just find creative ways to modify the game. He also found ways to cheat. There's like a degree of like, how do you get, you know, an advantage in these games, right? I think when you're 16 years old, it's very appealing because suddenly you have an advantage over most other people. Ben made cheats that allowed him to see through walls

and automatically aim at enemies. His Minecraft account was actually banned from some servers. Ben started talking about cheats with other players on Discord, a messaging app popular with gamers. And it's through those communities that Ben was introduced to another side of programming. Ben was entering the world of hacking. On Discord, Ben met people who were openly talking about cybercrime.

I started out with Minecraft, but maybe if you're servers over, you're entering reverse engineering, you're maybe finding a server related to malware. It's all like very interconnected and it's very easy to kind of be exposed to it because, you know, you meet friends with people. they're like, oh, join here, or they want to show you something, and as a result, kind of spirals. You know, looking at all this stuff, you know, I'm imagining you was a 16-year-old. You're clearly a curious guy. Did you ever think of going along with the crowd and becoming a hacker, too?

I think it's one of those things where people don't really, like, think about it. Like, I definitely push boundaries I should not have in hindsight. But I think the issue is, like, this normalization where if you spend all the, all your time around these communities, things stop becoming, the things that you would view as immoral or wrong, just start to become normalized. You know, spending a year maybe in the community, it's like, oh, you know, who cares, right? Like, it's just, yeah. It's just what people do. Exactly, right. Were you ever shocked by anything you saw that other people were doing on these servers? There was one thing that really stood out to me, I think, when I was like 16 years old,

But somebody had shared like this list of credentials for Spotify Premium, where it was a bunch of people stole an account. So it was like 100 email and passwords. A Spotify spokesperson encourages users to use strong, unique passwords to help keep account secure. By the way, this podcast is a co-production with Spotify. So please don't steal Spotify premium. I remember seeing this and like thinking to myself, oh my God. I mean, this is pretty egregious. And so I think I had emailed like all a hundred people.

people or 60 people on that list, like notifying them, hey, you know, your account was compromised, was shared. Ben saw that he was at a fork in the road. He could stay on the right side of the law, or he could follow in the footsteps of hackers. This wasn't going to lead down any good roads, right? Like, the people that are committing these crimes, maybe they get arrested, maybe you see it, right? It's something where I was like, okay, something has to change here.

Instead of cybercrime, Ben turned to cybersecurity. An early opportunity to use his skills for good came in his senior year of high school. The Dutch government was inviting hackers from all over the world to look for vulnerabilities on its websites. And the reward for finding a bug was a T-shirt. Ben decided to give it a go, and he found not one but two major bugs.

And so, like, I had reached out over email. I was like, hey, I found both of these vulnerabilities. And I think it was a couple months before I even heard back. But they were like, oh, you know, what size t-shirt do you want? What does it say? Oh, it's fully black and it has white text. And then, you know, the text says, heck, the Dutch government. And all I got was this lousy t-shirt.

It may have been a lousy t-shirt. But Ben says it was a dopamine rush. Over the next few years, he kept on learning. He moved to upstate New York to study computer science. and he learned all sorts of things, like how to automate tasks and build bots. And while Ben didn't know it, that path was leading him straight to a massive cyber weapon.

Because Ben was about to encounter the obscure piece of internet tech that powered Kim Wolf. They're called Residential Proxy Networks. Here's our colleague Bob again. Residential proxy is really a way of just masquerading as somebody else. Okay.

On the internet, we all have something that's like the equivalent of our phone number. It's called an IP address. And these IP addresses basically are good indicators of who's visiting your websites. What residential proxy does is it basically lets you Airbnb that IP address. Once your IP address is rented out, Internet traffic is then routed through your network for a small fee. So you might actually get paid to allow somebody to go from your IP address to anywhere on the internet. Residential proxies or res proxies, as they're sometimes known, are really useful. And not just for users who want to be anonymous online, but also for programmers who build bots that, for example, scrape web data.

But they also occupy a somewhat shady side of the internet. For one, res proxies can be used to hide. crimes. Any kind of online criminal activity. This could be like nation states hacking into corporations. This could be ticket scalpers trying to buy a bunch of tickets, you know, identity fraud. Wow. So it's basically any kind of crime you can think about that happens on the internet, happens with residential proxy networks. The companies behind res proxies can also be shady because they don't always source IP addresses ethically. Some res proxy companies get IPs by sneaking malicious software onto your devices.

There's software you can download that will put you on a residential proxy network without your knowledge or consent. There's a lot of, and there are devices you can buy that will also do that. What do you mean? What kinds of apps are devices? One place you need to be wearing is if you're downloading an app or buying a device that's going to let you watch content for free that you're supposed to be paying for,

there's a decent chance that's going to put you on a residential proxy network. Nothing is free. Yeah, nothing is truly free. Yeah, yeah. There's a reason why you're getting something that seems too good to be true. Other devices, like internet-connected appliances, can come with res proxy malware pre-installed.

It was like a crazy thing to start to realize that a lot of these IP addresses are, in fact, unethically obtained. Between classes, Ben Brundage used his free time to learn everything he could about residential proxies. To me, it was just like, oh, I feel like there's something more here. Like, it was just, you know, I feel like people should talk about it more. It seems interesting. There's a whole world here that people rarely touch on.

So from his dorm room, Ben started exploring that shady world. But what Ben didn't realize was that underneath that one, world, there lived a monster. That's after the break. After he got interested in residential proxies, Ben decided to analyze the IP addresses that made up their networks. He started keeping track of the suspicious IP addresses in a list, information he thought could be valuable. By August of last year, Ben had created his own one-man company called Synthiant. But as he cataloged IP addresses, Ben noticed something stranger still. The websites for a lot of the RES proxy providers were eerily similar. I was like, okay, these are exactly the same, right? They have a cookie

cutter website where checkout flow is the same. The website user interface is the same. The only thing that's different is like the brand name and, you know, the color palette maybe. As it turns out, behind those nearly identical websites was just one res proxy company called IPIDIA. Ben couldn't find much about IP Idea. The company didn't list a chief executive or a founder on its website. It didn't post an address. And actually, it appeared to operate under more than a dozen names. But what especially piqued Ben's curiosity was that IPIDA didn't have much in terms of security. IPIDia had no regulations, and so it's just like, oh, that's really, you know, interesting, right? Like most of these proxy providers, they have stuff in place that are like guardrails to prevent their users from committing fraud, let's say, right?

And the fact that they didn't stood out. IPIDA didn't respond to requests for comment. But a spokeswoman said earlier this year that the company always explicitly opposed illegal or abusive conduct on its network. Ben decided to focus his research on IP idea. By the start of his senior year in college, he had mapped out a huge chunk of the company's network of IP addresses. Then, Ben showed off his work online. He built an online tool that would let someone see if their IP address was on his list,

and he shared it on Discord. A week later, Ben got a message from a mysterious user. The user told Ben that he hadn't caught everything. They were like, okay, you're missing some IP addresses, and they send some screenshots of essentially their residential proxies, you know, not being detected by the service. So they're like, oh, you got a couple of them, but you didn't get all of them, essentially.

The mysterious user appeared to be a hacker, someone who was part of an operation that exploited devices on IPADIA to build a network of bots. They were definitely gloating. They also appeared to be selling access to their botnet. For a fee, other hackers could use the botnet for attacks. Cybercrime as a service.

Ben says he could tell this person was young. I think there's a certain way of typing that people my age tend to type in. Let's say on Discord or any social media where they use emojis more often or gifts or even like the language they use. So I think that was kind of the indicator that it's not going to be somebody that's in their 40s

or 30s, you know what I mean? Like, it's somebody probably around my age or younger. Ben kept talking to the hacker. He wanted to learn more. But he didn't want to come off too strongly, so he made jokes to keep things chill. And so I was like, okay, I'll just be on serious here and see kind of where it goes.

And so I sent this cat gift, which was like, you know, this cat essentially with a tuxedo on, you know, looking super professional. And, like, that was my way of saying that, you know, like, I'm not really that professional, right? The cat meme worked. It lightened the mood, and the hacker started sharing more details with Ben. He was able to obtain all these compromised devices using an unknown method, right?

And like these things stood out to me at the time because it was like, huh, I wonder what's actually going on here. The hacker also told Ben that the operation was huge. He told me that they were spending like $30,000 a month on infrastructure. like that was an insane amount of money. He also told me he's like, this isn't some rinky dink operation, right? And there's another comment which was like, don't investigate us essentially, right? And I think all three of those comments were like, okay, that's kind of suspicious, something way bigger is going on here.

The something way bigger was Kim Wolf. Ben had stumbled onto a dangerous botnet that had been launching massive DDoS attacks, designed to knock websites offline with floods of junk data. One attack was so large that it was as if everyone in Germany, Spain, and the United Kingdom had gone to the same website at the exact same second. Cybersecurity experts had been studying this botnet for months. One of those experts was an engineer at a networking company called Lumen. So not to be confused with the company from the show Severance, right?

Not to be confused with that, yes. Although it did increase our popularity. At Lumen, Chris Formosa had been researching the threat that residential proxy networks could pose to internet infrastructure. And a lot of his work focused on one res proxy company in particular, IP idea. That's where the botnet attacks seem to be coming from. The main thing we were interested in, how do we deal with this giant botnet? We were seeing it was growing at kind of an unchecked pace.

And a botnet of that scale can do a lot of extreme. damage. So one of the challenges we were facing is we didn't know how they were gathering these victims. But something didn't add up. While residential proxies enable plenty of crimes, companies like IPIDIA generally discouraged DDoS attacks like the one Kim Wolf was engaging in. That's because when devices participate in DDoS attacks, their IP addresses generally get blacklisted by websites across the internet, making them useless. That's bad business if you're trying to rent out IP addresses. Kim Wolf seemed to be using IP Ideas Network, but it wasn't clear how.

The worry is that these networks have millions and millions of IPs, and they don't often have security teams or kind of anybody checking what activity is happening. So if somebody finds a way to harness these millions of devices, they can use them to do really malicious activity like a large-scale deed house attacks. To find out what was going on, Chris needed to learn more about IP idea. The problem was that only a handful of people on the planet

knew much about the company. But then, a fellow cybersecurity researcher told Chris there was someone he should meet. You connected with Ben Brundage. What was your first impression of him? Yeah, I can't say enough about Ben. Ben kind of figured almost all of it out just by himself, which is nothing short of amazing. The first day we chatted for probably like eight hours straight, just passing notes back.

Eight hours? Yeah, it was just back and forth, just throwing notes to each other. And just we couldn't stop. It was just so much fun. For the next month, Ben and Chris worked together sharing notes about IP idea. Some of what Ben shared came from the conversations he'd had on Discord with that mysterious hacker. And after analyzing the IP addresses Ben had. cataloged, Chris realized that the hacker was likely connected to Kim Wolf.

Soon after they met, Chris introduced Ben to a group that was working on the Kim Wolf mystery, a group called Big Pipes. Big Pipes is an incredible group of people who really just want to make the world a lot better. Big Pipes is a cybersecurity working group, made up of Internet wizards from major internet companies. Soon, Ben was joining Big Pipe's weekly conference call, sharing what he knew. You know, to me it was like this crazy feeling because, you know, I'm just some college kid that, like, had found this by accident. But then it's like, oh, you know, it's actually contributing to something bigger was like this really rewarding feeling. It wasn't long after Ben started working

with Big Pipes that the group would run into a breakthrough moment when one of their own was hit by a Kimmelff attack. Here's our colleague Bob again. One of the companies in Big Pipes was looking at the traffic that was hitting their network. And they realized that one of their, own employees, like the IP address of one of their own employees was launching the attack. So they reached out to that employee and they said, could you do just some technical stuff on the network and see what is going on? That employee looked through their home network, trying to find the culprit. And what they found was surprising. One of the devices firing off junk data was a $50 digital picture frame, the kind you can update with photos from your

phone. I actually got my grandma one of those. And so that gave them something to look at, right? So they look at this device and they start trying to figure out why it's doing it. And they realized that something in this device was also allowing it to be part of Kim Wolf. Then it sort of pointed to like, are these devices somehow being hacked? That was like the question to get onto the Kim Wolf network. How Ben figured that out? is next. A digital picture frame belonging to a Big Pipes employee had become part of Kim Wolfe.

But it still wasn't clear how hackers were manipulating the device. Ben and Chris scoured the internet for clues. And Ben kept thinking about what that mysterious hacker had told him. I was definitely trying to figure out how everything was being done, right? Like, they claim they had this novel exploit. How were they actually achieving it, right? And so I was trying to like figure out these kind of loose strands and, you know, unravel the mystery, I guess. Ben wanted to see exactly how Kim Wolf could break into devices on IPID's network to build its cyber weapon. So he decided to set a trap, a honeypot that would lure in Kim Wolf. Here's Chris Formosa again. I'd say Ben's honeypot is the gold mine. That was the key. So the idea was

there's got to be, we think they're exploiting residential proxy devices. So the best way to figure out if that's true is make yourself a honeypot and become one. Here's how Ben set up the trap. I had this Android phone that I used for reverse engineering. As one does. Yeah, exactly. As one does. Ben installed IPIDA software onto that Android phone, downloading it from a website that offered pirated streaming apps.

Then, he built a setup that allowed him to monitor the internet traffic coming to and from that Android. Then, he waited. In the meantime, Ben studied for his midterm exams. I was so stressed during this time, but I think I had, like, set this tracking. I had this running for a week, and I saw this domain keep popping up called xd.resi.tto. XD.resi.tio, a strange web address that didn't seem to belong to IP Idea. And to me, that really stood out. I was like, oh, it's really interesting.

I wonder what's going on here. And it turns out that this was what they were using for their initial access or compromising the devices. Kim Wolfhackers had set up that domain to gain access to devices on IPIDIA's network. It was a direct link between the hackers and Ben's Android. And once they were in, Ben saw that Kim Wolf started doing something really unusual. Normally, residential proxies act like a tunnel between a user and whatever place on the internet they're trying to connect to. There are no stops or pauses. But Ben noticed that the traffic from that weird domain was somehow sticking around.

Here's Bob. Instead of going to another place on the internet, the hackers were saying, take us to someplace on your local network. Take us to this part of your phone where we can get control of your whole phone or your whole picture frame or your whole streaming device. They were only supposed to be using

the residential proxy to visit the internet, not to visit local networks. It's like if an Airbnb guest decided to squat in their rental and rummage through all the locked closets and drawers looking for stuff to steal. Ben took his findings back to the rest of big pipes, and together they discovered a bug in IPIDA's code, a bug that Kim Wolf hackers exploited to break into home networks and look for vulnerable devices. The hackers would then install software onto those devices that allowed them to engage in DDoS attacks.

What Ben's honeypot also revealed is that IPIDA and Kim Wolf weren't working together. Kim Wolf was paying for access to IPIDAs network and abusing it to hack into consumer devices. And so it's like, oh, you know, I kind of understand how they're doing it now. I understand how easy it is. And then I think it was also a bit scary, right? Like you can see all these domains and what people are sending requests to. And you see this one domain that's just the very, like, top here.

And it just means that they're compromising, just devices at an unseen scale before. Ben had solved the mystery. Eventually, Ben identified around 2 million devices, things like TV boxes, phones, cameras, picture frames, all hacked by Kim Wolf. Ben also found that IPIDA wasn't the only residential proxy company that was vulnerable to the bug. Ten other companies were, too.

The next step was to warn the world. Ben started writing notices to res proxy companies, including IP idea, to tell them about the bug and how to fix it. And at this point, you know, where are we at in the school year? What's happening to your college work? I think this was towards the end of finals. Even though I'm not like the best student, there's definitely a degree of like, you know, I have parents. Exactly. I have parents that love me.

And so like I have to do these things because otherwise, You know, they give me a bit of grief for it. You know, I love... You're also so close to graduating, so, you know... Exactly. Might as well keep going. Exactly, right. So I was just trying to wrap everything up.

One internet wizard told Bob that if Ben spent too much time studying for his finals, the internet might actually break. On December 17th, the day after his last test, Ben sent out the notices. Nine days later, IPIDIA finally replied, apologizing. They told Ben that his email

had gone to spam, but they said they were fixing the problem. But IPIDIA's fix came too little, too late. In January, Google used a U.S. court order to strike at IPIDIA, taking down 13 of the company's business domains and shutting down dozens of IPID's servers. Google had identified more than 10 million devices that came with IPIDA's software secretly pre-installed. Two months later, in March, the Department of Justice took action against four of the world's largest DDoS botnets, including Kim Wolf, by seizing internet domains, virtual servers, and other network infrastructure. According to court filings, Kimmulf had launched more than 26,000 DDoS attacks, targeting

over 8,000 victims. At the end of its press release, the DOJ thanked several companies for their help in the Kimmulf operation. They included Google, Lumen, and Synthiant, Ben's company. It's a really cool feeling. I'm being like 100% honest. Like this all was by, you know, accident, but it's also like rewarding in the sense of like,

you know, I spent all this time on here, spent, you know, maybe even sacrificed time from other things I should be giving it to, whether that's school or friends. And so it's cool to kind of see that, like, there's an actual impact or, you know, real world value to what I'm doing, I guess. In the case of Kim Wolf,

how important was Ben for that investigation? Ben was the most important, critical MVP, whatever you want to call it. That's Chris Formosa again, the Lumen Engineer. Ben really kind of figured out who the main actors were, who was likely running it, how they were doing it, how the exploitation work. Ben was kind of the key information piece around everything.

The people in Big Pikes, they would have eventually figured this out, but they sure got a lot of help from Ben. Bob McMillan again. Like the Big Pikes, people, they were the wizards who see the flows of data on the internet and they can see the, they can pick up the software that's being, you know, downloaded and they can see the IP addresses of everything. But they weren't on Discord discussion groups sharing

cat memes, right? That's not how they worked. These days, Kim Wolf is a shadow of its former self. But cybersecurity experts say it is still around, lurking in thousands of vulnerable And Bob says there are a lot of those out there. The real takeaway here is that we have an internet filled with junk. We have garbage devices, garbage apps that are doing a lot of bad stuff, and they've become part of the criminal infrastructure. It's like an internet pollution problem. That's the takeaway is that we have an internet pollution problem,

and we're not really sure how to fix it. By the way, if you want to see if there's a secret residential proxy device on your network, Bob wrote a quick guide on how to check. The link is in the show notes. As for Ben, he says he's now focused on graduating and on building his startup. And he also wants to take a break. I kind of want to travel a little bit and see what's out there. I kind of want to take a little bit of a vacation too, you know, I think after all this.

Yeah, you deserve that. You're going to make a T-shirt? You didn't get one out of this particular endeavor. Maybe you can make one for yourself. I've heard there's one on the way, so fingers crossed. Oh, is that right? That's what I've heard. We'll see, though. Do you know what it'll say?

I have no clue. Maybe it says, I saw Kim Wolf and all I got was this lousy t-shirt. That's all for today, Friday, May 1st. The Journal is a co-production of Spotify and the Wall Street Journal. This episode was produced by Enrique Perez de Larosa and edited by Colin McNulty. The show's made by Catherine Brewer, Pia Gidcarry, Sophie Codner, Ryan Conno. Newtson, Matt Kwong, Laura Morris, Sarah Platt, Alan Rodriguez-Espinoza, Heather Rogers, Pierce-Singee, Jiva-Coverma, Catherine Wayland, Tatiana Zemise, and me, Jessica Mendoza.

Our engineers are Griffin Tanner, Nathan Singapok, and Peter Leonard. Our theme music is by So Wiley. Additional music this week from Catherine Anderson, Peter Leonard, Billy Libby, Nathan Singapok, and Griffin-Tanner. Fact-checking this week by Kate Gallagher and Mary Mathis. Thanks for listening. See you on Monday.