RapperBot launched 370,000 DDoS attacks on 18,000 victims in 80+ countries since 2021, DOJ seizes botnet.

Feds say Mirai-spawned botnet blasted 370K attacks before AWS and pals helped yank its servers RapperBot, a botnet-for-hire blamed for hundreds of thousands of DDoS attacks, has been yanked offline by the Feds, who also hauled in its alleged Oregon-based mastermind.…

With the fall of RapperBot in August 2025, Aisuru quickly regained its position as the world’s most powerful DDoS botnet. By September, Aisuru had achieved record-breaking attacks, flooding targets wi...

DOJ charges 22-year-old Ethan Foltz of Oregon for running RapperBot, a DDoS botnet behind 370K+ attacks in 80+ countries since 2021.

The US Department of Justice has announced the takedown of the RapperBot botnet and charges against its American administrator.

RapperBot launched 370,000 DDoS attacks on 18,000 victims in 80+ countries since 2021, DOJ seizes botnet.

RapperBot launched 370,000 DDoS attacks on 18,000 victims in 80+ countries since 2021, DOJ seizes botnet.

RapperBot launched 370,000 DDoS attacks on 18,000 victims in 80+ countries since 2021, DOJ seizes botnet.

Cloudflare blocks record 7.3 Tbps DDoS attack, targeting hosting provider, with 122,145 source IPs across 161 countries.

DOJ charges 22-year-old Ethan Foltz of Oregon for running RapperBot, a DDoS botnet behind 370K+ attacks in 80+ countries since 2021. The U.S. DOJ charged 22-year-old Ethan Foltz of Oregon for running the RapperBot botnet, used in over 370,000 DDoS-for-hire attacks since 2021. The criminal service is active in over 80 countries, RapperBot enabled large-scale disruptions. Foltz, identified as its administrator, allegedly developed and managed the service, impacting global victims.

概述 RapperBot 是一个活跃的僵尸网络家族，最早由 CNCERT 于 2022 年 7 月公开并命名。FortiGuard Labs 在 2022 年 11 月的报告中将其活动时间追溯至 2021 年。2025 年 2 月，RapperBot 参与了针对 Deepseek 的攻击；自 3 月起其攻击行为显著活跃，日均攻击目标超过百个，观测到的 bot 数量超过 5 万。 该家族不仅...

: Feds say Mirai-spawned botnet blasted 370K attacks before AWS and pals helped yank its servers

The U.S. Department of Justice (DOJ) has charged Ethan Foltz, a 22-year-old from Oregon, for operating the RapperBot botnet, which has been implicated in over 370,000 DDoS-for-hire attacks since 2021. This botnet has affected more than 80 countries, causing significant disruptions to online services and economic damage. RapperBot is a network of compromised devices controlled by Foltz to launch distributed denial-of-service (DDoS) attacks. These attacks overwhelm target systems with traffic, rendering them inaccessible to legitimate users. The scale and global reach of RapperBot highlight the persistent threat of DDoS-for-hire services, which lower the barrier to entry for cybercriminals. The DOJ's action against Foltz underscores the importance of international cooperation in combating cybercrime and serves as a deterrent to others involved in similar activities. For cybersecurity professionals, this case emphasizes the need for robust DDoS protection measures, including sufficient bandwidth, mitigation services, and incident response plans. It also highlights the importance of keeping systems updated, using strong authentication, and monitoring network traffic for signs of compromise. Organizations should consider participating in threat intelligence sharing initiatives to stay informed about emerging threats and collaborate on defense strategies. The economic impact of these attacks underscores the necessity for businesses to invest in comprehensive cybersecurity measures to protect against botnet infections and DDoS attacks.

A sophisticated botnet campaign targeting digital video recorders (DVRs) has emerged as a significant threat to surveillance infrastructure worldwide, with cybercriminals exploiting vulnerable IoT devices to build massive botnets capable of large-scale distributed denial-of-service attacks. RapperBot, a variant of the notorious Mirai malware, has been systematically compromising DVR systems to gain unauthorized access to surveillance cameras and their recording capabilities, creating serious privacy and security implications for organizations and individuals alike. The malware campaign has demonstrated remarkable persistence and evolution over the past three years, with attackers continuously refining their techniques to evade detection and maximize infection rates. DVRs present particularly attractive targets due to their constant internet connectivity, weak default passwords, and infrequent firmware updates, making them ideal candidates for long-term botnet recruitment. NICTER analysts noted that RapperBot operators have developed four distinct malware variants, each designed for specific attack scenarios and reconnaissance purposes. The campaign gained significant attention when researchers identified a coordinated attack against X (formerly Twitter) on March 10, 2025, where the timing of RapperBot’s DDoS command distribution directly correlated with the platform’s service disruption. The malware’s targeting strategy focuses on DVRs manufactured by Korean OEM ITX Security and distributed across multiple brands, demonstrating how a single firmware vulnerability can cascade across numerous product lines. This supply chain vulnerability pattern has enabled attackers to compromise devices from various manufacturers using identical exploitation techniques, significantly amplifying the campaign’s reach and impact. Advanced Infection Mechanism and Evasion Tactics RapperBot employs a sophisticated multi-stage infection process that begins with reconnaissance -type scanners systematically probing potential targets. RapperBot infection chain (Source – Nicter) The Recon variant implements a strategic approach where successful login attempts trigger device identification procedures, with acquired information transmitted to report servers alongside specific type identifiers. This intelligence-gathering phase enables attackers to customize subsequent exploitation attempts based on precise device characteristics. The malware’s latest iterations have incorporated advanced evasion techniques, particularly in command-and-control communications. Recent versions utilize encrypted TXT records for C2 server resolution and implement randomized TLS signature algorithms to blend with legitimate HTTPS traffic. The malware generates varying JA4 fingerprints for each connection attempt, making network-based detection significantly more challenging for security systems monitoring encrypted communications patterns. The post RapperBot Attacking DVRs to Gain Access Over Surveillance Cameras to Record Video appeared first on Cyber Security News .

Cloudflare mitigated a record 11.5 Tbps DDoS attack in 35 seconds, highlighting rising hyper-volumetric threats.