Oregon Man Charged in Connection with 'RapperBot' DDoS-for-Hire Botnet

Federal authorities have charged a 22-year-old Oregon resident, Ethan Foltz, with allegedly developing and administering the 'RapperBot' botnet, a sophisticated distributed denial-of-service (DDoS)-for-hire service.

RapperBot has been implicated in over 370,000 cyberattacks targeting victims across more than 80 countries since at least 2021.

According to the U.S. Department of Justice, Foltz, a resident of Eugene, Oregon, faces charges of aiding and abetting computer intrusions.

If convicted, he could face a maximum penalty of 10 years in prison.

On August 6, 2025, law enforcement executed a search warrant at Foltz's residence, seizing control of the botnet's infrastructure and effectively terminating its operations.

RapperBot, also known as 'Eleven Eleven Botnet' and 'CowBot,' primarily compromised devices such as digital video recorders (DVRs) and Wi-Fi routers by infecting them with specialized malware.

Clients of RapperBot could then command these infected devices to send massive volumes of DDoS traffic to targeted computers and servers worldwide.

The botnet's attacks often measured between two to three terabits per second (Tbps), with the largest attack potentially exceeding six Tbps.

Such attacks have caused significant disruptions, including an incident earlier this year that briefly took down the social media platform X.

Investigators allege that Foltz and his co-conspirators monetized RapperBot by providing paying customers access to its powerful DDoS capabilities.

Between April 2025 and early August, the botnet conducted over 370,000 attacks, targeting 18,000 unique victims, including U.S. government networks, social media platforms, and technology companies.

Amazon Web Services (AWS) played a crucial role in the investigation by identifying RapperBot's command-and-control infrastructure and reverse-engineering the malware to map its operations.

The disruption of RapperBot is part of Operation PowerOFF, an ongoing international effort aimed at dismantling criminal DDoS-for-hire infrastructures worldwide.

Authorities emphasize the significant financial impact of such attacks, noting that a DDoS attack averaging over two Tbps per second lasting 30 seconds could cost a victim anywhere from $500 to $10,000.

Some RapperBot clients allegedly engaged in extortion, leveraging the botnet's capabilities to demand ransoms from victims.

Foltz's arrest and the dismantling of RapperBot mark a significant victory in the fight against cybercrime, highlighting the collaborative efforts of law enforcement and private sector partners in addressing complex cyber threats.