Poland Busts 4 as Part of Stresser/Booter Service Crackdown

Police in Poland have arrested four people as part of a crackdown on a network of services that sold distributed denial-of-service attacks on demand.

See Also: AI-Powered AML with Faster Detection and Stronger Compliance

The DDoS services offered on-demand attacks against websites and servers, flooding them with junk traffic to make them publicly inaccessible, for as little as $11 per disruption, police said.

All of the arrested individuals are suspected service administrators.

“The now defunct platforms – Cfxapi, Cfxsecurity, neostress, jetstress, quickdown and zapcut – are thought to have facilitated widespread attacks on schools, government services, businesses and gaming platforms between 2022 and 2025,” Europol said.

Authorities tied the six user-friendly – but illegal – DDoS services to thousands of successful attacks. “The platforms offered slick interfaces that required no technical skills,” Europol said. “Users simply entered a target IP address, selected the type and duration of attack and paid the fee – automating attacks that could overwhelm even well-defended websites.”

German authorities contributed intelligence that led to the arrest of one of the six Polish suspects.

Operation PowerOFF Continues

The arrests occurred as part of the ongoing international law enforcement effort codenamed Operation PowerOFF, which aims to seize or otherwise disrupt the infrastructure used to power DDoS-for-hire attack services.

Also this week, U.S. authorities seized nine domains tied to stresser/booter services – so-called because the malicious services often portray themselves as being legitimate tools for testing sites’ availability and load-balancing capabilities.

Those collective anti-DDoS service efforts followed law enforcement agencies worldwide last December dismantling more than two dozen such services, in a strike timed to occur just before the holiday season, when such attacks tend to escalate, often tied to ongoing gaming.

Stresser/booter services get regularly advertised across cybercrime forums and marketplaces – including on so-called darkweb sites reachable only through the anonymizing Tor browser – and often accept payment in cryptocurrency, to help users maintain their anonymity.

Non-malicious IP stresser tools do exist for use by network owners. “The administrator may run a stress test in order to determine whether the existing resources – bandwidth, CPU, etc. – are sufficient to handle additional load,” said DDoS-defense firm Cloudflare.

“Testing one’s own network or server is a legitimate use of a stresser,” Cloudflare said. “Running it against someone else’s network or server, resulting in denial-of-service to their legitimate users, is illegal in most countries.”

Traditionally, criminals built such services by using malware to infect PCs and press them into service as part of a DDoS attack. “These DDoS botnets are networks of malware-infected computers exploited to make a victim server or network resource unavailable by overloading the device with massive amounts of fake or illegitimate traffic,” the FBI said.

More recently, many stresser/booter services instead use “centralized, rented infrastructure” to execute attacks, Europol said.

Cops Deploy Bogus Services

To deter the use of such services, multiple law enforcement agencies, including the National Crime Agency in the U.K. as well as Dutch law enforcement, say they now run bogus cybercrime service sites. These are designed in part to unmask people seeking to use such services, as well as sow fear and confusion among criminals (see: Law Enforcement Lures Cybercriminals With Fake DDoS Services).

In 2023, the NCA reported that one of its bogus DDoS-for-hire sites had already been “accessed by around several thousand people.” Officials said law enforcement agents regularly pay domestic users a visit to try and warn them away from such activity, as well as share intelligence.

Intelligence-sharing was key to the arrest of the four suspects in Poland. “Data from booter websites seized by Dutch law enforcement in data centers in the Netherlands was shared with international partners, including Poland, contributing to the arrest of the four administrators,” Europol said.

As part of Operation PowerOFF, authorities said they’ve now arrested 10 people, seized in total 24 stresser/booter services, taken down 36 domains and identified more than 300 service users.