Four Plead Guilty in FBI’s Latest DDoS-for-Hire Sweep

Four US citizens have pleaded guilty to committing cybercrimes after the FBI announced it took down 13 domains linked to hacker-for-hire services.

The seizures announced by the US Department of Justice this week form a third wave of actions against prominent booter/stressor services that allow paying hackers to launch powerful distributed denial-of-service (DDoS) attacks against various targets.

“Data relating to the operation of booter sites previously seized by law enforcement show that hundreds of thousands of registered users have used these services to launch millions of attacks against millions of victims,” the Justice Department said. “School districts, universities, financial institutions and government websites are among the victims who have been targeted in attacks launched by booter services.”

Ten of the 13 domains seized this week are rebooted versions of services seized during a similar sweep in December.

To confirm that the DDoS services functioned as claimed, the feds opened or renewed accounts with each service and used cryptocurrency to pay for subscription plans. Agents then used them to launch DDoS attacks on computers controlled by the FBI and observe the effects on “victim” computers. The websites operated as advertised and, in some cases, the attack was so powerful that it completely severed the internet connection, even on networks with a large traffic capacity.

According to the feds, such powerful attacks can harm not just the target but can also sever internet connections for others who share the same connection point.

“Victims who are attacked by such services, or those providing Internet services to the victims, often have to ‘overprovision,’ that is, pay for increased Internet bandwidth in order to absorb the attacks, or subscribe to DDoS protection services, or purchase specialized hardware designed to mitigate the effects of DDoS attacks,” according to the affidavit in support of the seizure warrants filed this week.

“The prices of such overprovision or DDoS protection services are usually significantly more expensive than the cost of a given booter service,” the affidavit continued.

Four defendants between the ages of 19 and 37 pleaded guilty to operating or participating in the operation of the seized services.

The use of booter or stresser services to conduct a DDoS attack is punishable under the Computer Fraud and Abuse Act and can result in a prison sentence of up to 10 years. The defendants are scheduled for sentencing this summer.