'One of the most powerful DDoS botnets to ever exist' has been taken down by the DoJ with help from Amazon Web Services, Google, Cloudflare and others
The US Department of Justice has charged 22-year-old Oregon man Ethan Foltz in relation to his alleged involvement in the development and administration of RapperBot, a notorious DDoS-for-hire botnet.
Foltz has been charged with one count of aiding and abetting computer intrusions, which, if convicted, would lead to a prison sentence of up to 10 years. The charges were made in the form of a federal criminal complaint in the District of Alaska, but it's not just the DOJ taking credit for Rapperbot's dismantling—as Amazon Web Services appears to have had its part to play, too.
According to infrastructure vice president Tom Scholl, AWS worked closely with the Defense Criminal Investigative Services (DCIS) to identify the botnet's command and control infrastructure, before reverse engineering it in order to map its operations and activities.
As a result, the administrative control center of the botnet was said to have been seized during a raid on the accused man's home as part of "Operation PowerOff" on August 6, marking the end of a DDoS-for-hire operation that's known to have been active since at least 2021 (via Bleeping Computer).
Rapperbot is believed to be responsible for infecting tens of thousands of DVRs, routers, and IoT devices, before marshalling their collective network firepower to overwhelm organisations in over 80 countries, including US government systems, gaming companies, and several large tech firms. Paying customers are alleged to have hired the botnet to carry out attacks on these targets on their behalf.
According to AWS, Rapperbot conducted over 370,000 attacks since April of this year alone, with attack sizes ranging from several terabits to over 1 billion packets-per-second. That's a whole lot of traffic to target in one place, and enough to effectively paralyse the internet infrastructure of an organisation—and give its network engineers and cybersecurity consultants a serious headache.
However, it seems that Foltz wasn't acting entirely alone, as the DOJ announcement references unnamed co-conspirators alongside the charge brought against him. That being said, the raid on the accused man's home appears to have brought an end to RapperBot's operations, as the DOJ now claims to have full administrative control.
U.S. Attorney Michael J. Heyman for the District of Alaska said: "Rapper Bot was one of the most powerful DDoS botnets to ever exist, but the outstanding investigatory work by DCIS cyber agents and support of my office and industry partners has put an end to Foltz’s time as administrator and effectively disrupted the activities of this transnational criminal group"
"Our office remains committed to disrupting and dismantling cyber criminals that threaten internet security and infrastructure in the District of Alaska and across the United States."
The DOJ also says that assistance was provided by a number of other organisations in the operation, including Cloudflare, Digital Ocean, Google, and PayPal. A veritable who's who of would-be tech crimestoppers, then. We'll have to start thinking up a name, at this point. The Justice League, perhaps? No, I think that one's already taken.