Massive DDoS-for-hire network seized

Authorities have seized a major DDoS empire and arrested four individuals in conjunction with the widespread operation that allowed bad actors to launch cyberattacks worldwide.

Law enforcement authorities in Poland have arrested four people who allegedly controlled and ran a network of different platforms used to launch Distributed Denial of Service (DDoS) attacks worldwide.

The apprehended people are said to be behind “six separate stresser/booter services that enabled paying customers to flood websites and servers with malicious traffic,” Europol said.

Stresser and booter services are used on demand and are often marketed as legitimate testing sites to evade detection.

However, they are usually used to cause purposeful disruption to websites by overloading the site with malicious traffic, eventually rendering it unusable for a certain period of time.

These platforms allowed low-skilled threat actors to knock websites and servers offline for as little as 10 euros.

The sites Cfxapi, Cfxsecurity, neostress, jetstress, quickdown, and zapcut, which are now offline, were thought to be responsible for various attacks on schools, government institutions, businesses, and gaming platforms, Europol said.

The Department of Justice said that similar booter services were used to attack various victims in the United States and abroad, including the institutions and organizations listed above, as well as “millions of people.”

These websites offered “slick interfaces” that lowered the barrier for entry into cybercrime, meaning that low-level cybercriminals were able to use the platforms with ease.

All a cybercriminal would need to do is enter the target's IP address, select the type and duration of the attack, and pay. It was that simple.

Polish authorities arrested the so-called administrators of the operation in conjunction with law enforcement agencies in Germany, the Netherlands, Poland, the US, and Europol.

Dutch authorities set up fake booster sites, which were designed to warn users who are seeking DDoS services.

This reinforced “the message that those who use these tools are being watched and could face prosecution,” Europol said.