Garlic Gone Wild: How 700,000 Bots Tried to Hijack the Anonymous Internet

If there was an award for “Most Chaotic Entrance of the Month,” Kimwolf would already be clearing shelf space.

The headline act? A botnet, allegedly powered by around 1.4 million compromised IoT devices, because apparently your smart toaster yearns for cybercrime, decided it would take a little stroll into the I2P network. And by “a little stroll,” we mean it tried to shove roughly 700,000 hostile nodes through the door at once.

Subtlety was not invited.

First, A Quick Refresher

I2P, for the uninitiated, is anonymity infrastructure with a slightly different flavour to Tor.

Tor is your classic onion routing setup, layered encryption, peel it back one relay at a time.

I2P? It prefers garlic routing. Multiple encrypted messages bundled together into one transmission. Efficient. Discreet. Mediterranean, almost.

It also separates inbound and outbound tunnels, making traffic analysis considerably trickier. Clever architecture. Early-2000s vintage. Niche, but purposeful. Typically running at around 15,000 active nodes, not sprawling, but sturdy.

Until 3rd February.

When 15,000 Meets 700,000

Kimwolf’s operators were already feeling the heat. Security researchers had reportedly taken aim at around 500 of their core command-and-control servers, and that tends to ruin anyone’s week.

So the alleged strategy? Strengthen and obfuscate the botnet by leveraging I2P’s anonymity. Blend in. Disappear into the encrypted garlic mist.

Instead, they stampede-charged the network with 700,000 malicious nodes.

The result? Less “stealth infiltration.” More “elephant in a porcelain factory.”

The sudden flood completely swamped I2P’s routing capacity. Legitimate routers froze. Connections buckled. The protocol choked under the weight. In trying to hide inside the network, they effectively body-slammed it.

Cyber subtlety, this was not.

A Self-Inflicted Sybil

Shortly after, the operators reportedly admitted on Discord that they had accidentally triggered a Sybil attack, the technical term for flooding a decentralised network with fake nodes until the real ones can’t function properly.

In short: they tried to make themselves harder to track and instead DoS’d the very anonymity layer they were hoping to weaponise.

It’s the digital equivalent of hiding in a crowd by driving a tank into it.

For added context, this is the same botnet ecosystem believed to have powered one of last year’s largest DDoS attacks, peaking at 31.4 terabits per second. This is not small-time mischief. This is industrial-grade disruption.

And yet, even industrial-scale botnets can trip over their own ambition.

The Counterpunch

To I2P’s credit, the development team moved quickly. Within days, updates were released featuring:
* Post-quantum encryption enhancements
* Sybil attack mitigations
* Stability improvements for saturated routing environments

The network remains operational, though not yet fully restored to its pre-incident scale and stability. Recovery in decentralised ecosystems is more marathon than sprint.

But there’s a quiet irony here.

An anonymity network designed to resist surveillance was stress-tested not by regulators or law enforcement, but by criminals overplaying their hand.

The Bigger Picture

This wasn’t just a botnet mishap. It was a live-fire demonstration of how fragile decentralised systems can become when weaponised at scale.

It also highlights a recurring truth in cyber operations: scale amplifies power, but it also amplifies mistakes.

Kimwolf tried to disappear into the shadows. Instead, it turned on the floodlights.

Sometimes the garlic bites back.