- Europol announced shutting down multiple stresser/booter services in the EU
- Four people were arrested in Poland
- Law enforcement in The Netherlands, Germany, the US, and Poland, participated in Operation PowerOFF
Law enforcement has dismantled a major DDoS-for-hire operation, and arrested four individuals suspected of running it.
In a press release, the international police force said the arrests were part of Operation PowerOFF, an ongoing effort targeting the infrastructure behind DDoS-for-hire activity.
Polish authorities arrested four people who are suspected of running multiple stresser/booter services: Cfxapi, Cfxsecurity, neostress, jetstress, quickdown and zapcut.
Chats leaked
These services are thought to have facilitated “widespread attacks on schools, government services, businesses, and gaming platforms” between 2022 and 2025.
They featured a “slick” interface that lowered the barrier for entry: users didn’t need any particular technical knowledge to mount an attack. All they needed to do was know the victim’s IP address, and to have €10 to pay for the attack (the cost would increase depending on the desired length of the attack).
As part of the effort, Dutch authorities were deploying fake booter sites, designed to warn users looking for DDoS-for-hire services. They also seized data from booter websites hosted in data centers in the Netherlands, providing their partners with crucial information needed to make the arrests.
In the US, the police seized nine domains associated with booter services, and in Germany, the police identified one of the suspects. Europol said it provided analytical and operational support throughout the investigation.
The difference between usual DDoS botnets and stresser/booter services is that DDoS botnets are usually run by a single threat actor, which also works on expanding the botnet by deploying backdoors and malware.
Stresser/booter services, on the other hand, are advertised as a white hat solution, offering a “legitimate” service to test the resilience of a network or a website. However, in most cases, these are just cover-ups for obvious illegal activities, which is why law enforcement usually shuts them down.
