Global Crackdown on DDoS-for-Hire Services Yields Arrests and Domain Seizures
Law enforcement agencies from 21 countries conducted a coordinated strike against illegal DDoS-for-hire services on 13 April 2026 as part of Operation PowerOFF, a long-running effort to disrupt cybercriminal platforms. The operation targeted so-called "booters" or "stressers" websites that allow users with minimal technical knowledge to launch DDoS attacks for as little as a few dollars.
During the latest action, authorities arrested four individuals and seized 53 web domains linked to these services. Europol, which played a central role in the investigation, revealed that seized databases contained details of over 3 million criminal user accounts. To deter future misuse, law enforcement sent 75,000 warning letters and emails to users, including hobbyists and young offenders, emphasizing the legal consequences of their actions.
The operation also employed preventive measures, such as redirecting Google search ads for DDoS-for-hire services to law enforcement warnings and tracking cryptocurrency payments to issue additional alerts. DDoS-for-hire platforms have become a low-barrier entry point for cybercrime, enabling attacks that disrupt businesses, government services, and individuals by overwhelming targets with malicious traffic.
Operation PowerOFF has been active for years, with notable past successes, including the 2018 shutdown of Webstresser.org (which had 136,000 users and launched 4 million attacks) and the 2022 seizure of IPStresser.com. In 2023, the U.S. Department of Justice took down over a dozen DDoS-for-hire domains, while 2024 saw 15 countries dismantle 27 more sites, including zdstresser.net and orbitalstress.net, alongside three arrests in France and Germany. May 2025 brought the arrest of four individuals in Poland for operating platforms like Cfxapi, where attacks cost as little as €10. Most recently, in March 2026, authorities disrupted four major botnets Aisuru, KimWolf, JackSkid, and Mossad used to amplify DDoS attacks.
While the seizures and arrests have not eradicated DDoS-for-hire services, they have significantly raised the operational costs and risks for cybercriminals, making it harder to sustain large-scale disruptions.
Source: https://hackread.com/operation-poweroff-ddos-for-hire-services-identified/
Akamai Technologies cybersecurity rating report: https://www.rankiteo.com/company/akamai-technologies
"id": "AKA1776515140",
"linkid": "akamai-technologies",
"type": "Cyber Attack",
"date": "4/2026",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'customers_affected': 'Over 3 million criminal user '
'accounts',
'location': 'Global (21 countries involved in '
'operation)',
'name': 'DDoS-for-hire service users',
'type': 'Individuals/Criminals'},
{'industry': 'Various',
'location': 'Global',
'name': 'Businesses, government services, and '
'individuals targeted by DDoS attacks',
'type': 'Organizations/Individuals'}],
'attack_vector': 'DDoS (Distributed Denial of Service)',
'data_breach': {'number_of_records_exposed': 'Over 3 million',
'sensitivity_of_data': 'High (criminal activity records)',
'type_of_data_compromised': 'Criminal user account details'},
'date_detected': '2026-04-13',
'date_publicly_disclosed': '2026-04-13',
'description': 'Law enforcement agencies from 21 countries conducted a '
'coordinated strike against illegal DDoS-for-hire services on '
'13 April 2026 as part of Operation PowerOFF. The operation '
"targeted 'booters' or 'stressers' websites that allow users "
'to launch DDoS attacks for as little as a few dollars. '
'Authorities arrested four individuals, seized 53 web domains, '
'and sent 75,000 warning letters to users. Seized databases '
'contained details of over 3 million criminal user accounts. '
'Preventive measures included redirecting Google search ads to '
'law enforcement warnings and tracking cryptocurrency payments '
'to issue alerts.',
'impact': {'data_compromised': 'Details of over 3 million criminal user '
'accounts',
'operational_impact': 'Disruption of businesses, government '
'services, and individuals due to DDoS '
'attacks',
'systems_affected': 'DDoS-for-hire platforms, targeted '
'businesses/government services/individuals'},
'investigation_status': 'Ongoing (Operation PowerOFF is a long-running '
'effort)',
'lessons_learned': 'DDoS-for-hire services remain a persistent threat, but '
'coordinated law enforcement actions can significantly '
'disrupt cybercriminal operations and raise operational '
'costs for attackers.',
'motivation': 'Financial gain, disruption of services, low-barrier entry for '
'cybercrime',
'post_incident_analysis': {'corrective_actions': 'Domain seizures, arrests, '
'warning letters, search ad '
'redirection, cryptocurrency '
'tracking',
'root_causes': 'Low-barrier entry for cybercrime, '
'financial incentives for '
'DDoS-for-hire services, lack of '
'awareness about legal '
'consequences'},
'recommendations': 'Enhance international cooperation, implement preventive '
'measures like search ad redirection, track cryptocurrency '
'payments, and educate users about legal consequences of '
'DDoS-for-hire services.',
'references': [{'source': 'Europol'}, {'source': 'Operation PowerOFF'}],
'regulatory_compliance': {'legal_actions': 'Arrests of four individuals'},
'response': {'communication_strategy': '75,000 warning letters and emails '
'sent to users',
'containment_measures': 'Seizure of 53 web domains, arrests of '
'four individuals',
'law_enforcement_notified': 'Yes (coordinated by Europol)',
'remediation_measures': 'Redirecting Google search ads to law '
'enforcement warnings, tracking '
'cryptocurrency payments to issue alerts',
'third_party_assistance': 'Europol, law enforcement agencies '
'from 21 countries'},
'stakeholder_advisories': 'Law enforcement agencies issued warnings to 75,000 '
'users of DDoS-for-hire services about legal '
'consequences.',
'threat_actor': 'Cybercriminals operating DDoS-for-hire services',
'title': 'Global Crackdown on DDoS-for-Hire Services Yields Arrests and '
'Domain Seizures (Operation PowerOFF)',
'type': 'DDoS-for-Hire Disruption'}