Police from 15 Countries Shut Down Major DDoS-for-Hire Platforms

A major joint operation involving law enforcement agencies from 15 countries has dismantled 27 distributed denial-of-service (DDoS) platforms.

The operation, dubbed “Operation PowerOFF,” has also led to the arrest of multiple administrators of such platforms and helped authorities identify hundreds of their customers.

The scope of the operation

DDoS-for-hire services, also known as “stressers” or “booters,” allow users to launch debilitating attacks against online targets for a fee. These attacks are designed to cause severe outages and business disruptions.

DDoS platforms operate by harnessing botnets consisting of compromised devices, weaponizing the machines to flood targeted systems with overwhelming traffic and rendering them inoperable.

Europol, supported by analytical expertise, crypto-tracing and forensic investigation assistance from the Joint Cybercrime Action Team (J-CAT), led the initiative to dismantle these platforms, thus denying service to the denial-of-service operators.

Arrests, seizures, customer identification and legal action

Authorities seized 27 websites, including zdstresser[.]net orbitalstress[.]net and starkstresser[.]net; visitors of these websites are now greeted with seizure notices.

As part of the operation, three administrators linked to these illicit platforms were apprehended and some 300 people who had used the seized DDoS services were identified.

Some customers were arrested, many others received warnings

Law enforcement agencies are taking varied approaches to address identified users, ranging from issuing warnings to discourage further use to criminal charges, depending on the scale and severity of their involvement.

The Dutch Police (Politie) arrested four individuals, aged 22 to 26, as part of the operation. One was accused of conducting more than 4,000 DDoS attacks, while the others were linked to hundreds of such incidents.

The United States Department of Justice (DoJ) also indicted two individuals with ties to infamous booter services. Among them is 22-year-old Ricardo Cesar Colli from Brazil, who operated securityhide[.]net and securityhide[.]com under the moniker “TotemanGames.” An unnamed individual was charged for administrating other notorious DDoS-for-hire platforms.