Feds Seize Powerful DDoS-for-Hire Service ‘Rapper Botnet’

Federal prosecutors charged an Oregon man with administering an on-demand service for disrupting websites called “Rapper Bot.”

See Also: Why Cyberattackers Love ‘Living Off the Land’

Also known as the Eleven Eleven Botnet and CowBot, the distributed-denial-of-attack service regularly disrupted websites since early 2021 by pummeling them with trillions of bits’ worth of junk traffic from a botnet, prosecutors said. The botnet is composed of many different types of compromised internet of things devices, including digital video recorders and WiFi routers.

The U.S. Department of Justice on Tuesday named Ethan J. Foltz, 22, as being a key developer and administrator behind the botnet. He’s been charged with one count of aiding and abetting computer intrusions, which carries a maximum sentence of 10 years in prison.

Rapper Bot operated from approximately January 2021 until earlier this month, executing attacks on demand that appeared to peak at more than 6 terabits per second, affecting victims across 80 different countries, according to court documents. “A DDoS attack averaging over two terabits per second lasting 30 seconds might cost a victim anywhere from $500 to $10,000,” prosecutors said.

Attacks launched by Rapper Bot early this year disrupted both AI platform DeepSeek as well as social platform X, said Chinese cybersecurity company Qi An Xin Technology Group. “In recent samples, we noticed that RapperBot seems to have started extorting victims, demanding ‘protection fees’ to avoid DDoS attacks,” the company said in a June report.

The botnet is based on a variant of the Mirai malware, which debuted in August 2016, when it was used in massive attacks that disrupted major websites run by the likes of Amazon, PayPal, Spotify and Twitter. Someone leaked the source code onto cybercrime forum HackForums, guaranteeing that cybercriminals would use it to launch a slew of copycat botnets.

Investigators said Rapper Bot appears to have evolved from fBot, aka Tsunami, a Mirai variant notable for having the added ability to force infected systems – aka bots – to mine for Ethereum cryptocurrency.

The Rapper Bot investigation is being led by the U.S. Department of Defense’s Defense Criminal Investigative Service, which said the botnet has been tied to multiple attacks that disrupted organizations that provide internet services to the Pentagon, among thousands of other victims.

An affidavit from investigators submitted in support of an application for a criminal complaint and arrest warrant, dated Monday, was authored by DCIS Special Agent Elliott R. Peterson. A former FBI agent, Peterson has served as the government’s lead investigator for numerous DDoS cases, including of the Mirai botnet and multiple variants – such as Nexus-Mirai, Satori, Masuta and fBot – as well as for its probe into the Anonymous Sudan DDoS hacktivism group, which the FBI disrupted in March 2024 (see: US Indicts Sudanese Brothers for Anonymous Sudan Attacks).

Record-Setting Attacks

Investigators said they suspect that Rapper Botnet was typically comprised of 65,000 to 95,000 infected devices, or bots, that regularly launched attacks that sustained 2 or 3 terabits per second, although sometimes peeked at more than 6 terabits per second. The original Mirai botnet comprised about 300,000 IoT devices and sustained attacks that reached 1 terabit per second.

Investigators said a private firm, which they didn’t name, reverse-engineered Rapper Bots’ communications protocol and subsequently tracked attack commands being issued from C2 servers to bots. Based on its data, from April through early August, Rapper Bot launched more than 370,000 attacks against 18,000 unique victims, with the top victims being Amazon Web Services, Google Cloud, Eons Data Communications, Everymatrix and Microsoft.

Folzer allegedly registered the domain being used to control the Rapper bots, ballpit.cc, using the Airmail privacy-centric email service and paying through PayPal. In response to a legal request from investigators, PayPal supplied records “indicating that the specified Airmail email address was potentially associated with several accounts in the name of Ethan Foltz and that these Foltz accounts were themselves associated with Google Gmail accounts.” Based on internet service provider records for Foltz’s residence, investigators said that despite his apparent VPN use, they found the “IP overlap,” meaning the same IP address being used on multiple occasions to simultaneously access his Gmail and PayPal accounts.

On July 12, Peterson’s affidavit says he issued a federal search warrant to Google for Foltz’s records, which “revealed extensive evidence linking Foltz to Rapper Bot,” including multiple searches for the Mirai source code – most recently in March – as well as a copy of the source code being stored in his Google Drive account, alongside multiple searches tied to malware development. Over 100 searches for “RapperBot” and “Rapper Bot,” apparently tied to regular reviews of cybersecurity blogs, to keep track of what was being known and reported about the

Suspect Gives Feds Access

DCIS agents executed a federal search warrant at Foltz’s residence on Aug. 6, read him his rights then interviewed him at the scene.

“During this recorded interview Foltz stated that he was the primary administrator of Rapper Bot, that his primary partner was an individual he knew only as ‘SlayKings'” – who served as the service’s main reseller – “and that the code was influenced and/or derived not just from Mirai, but also from the DDoS botnet known as Tsunami and fBot,” the affidavit says.

Investigators said they asked to use Foltz’s administrator credentials, which he shared. They said a list of service users they viewed suggested there were currently 18 active users, of which four or five appeared to be other administrators or support staff.

Foltz reportedly told the investigators that his C2 server communicated with two arrays of proxy servers. One array served as “bot controllers” to communicate with infected devices. The other array served as “client proxies” that ran a dashboard that customers used to order attacks, with each customer being able to access only 10,000 to 30,000 botnets at a time, and allowed to execute up to 100 attacks with a maximum duration of 60 seconds.

“On the date of my visit, the botnet contained an estimated 65,000 victim devices, a ‘Goldilocks’ number of devices which afforded powerful attacks while still being manageable to control and, in the hopes of Foltz and his partners, small enough to not be detected,” the affidavit says.

Prosecutors said the investigation into Rapper Botnet is being done in conjunction with the international law enforcement Operation PowerOFF targeting DDoS-for-hire infrastructure worldwide. That effort remains ongoing, not least because new service providers continue to emerge even as existing ones get arrested (see: Poland Busts 4 as Part of Stresser/Booter Service Crackdown).