A Coordinated Global Strike Against DDoS-for-Hire Infrastructure
In a sweeping internationally coordinated effort, law enforcement agencies from 21 countries seized 53 domains and arrested four individuals allegedly connected to distributed denial-of-service operations that served more than 75,000 cybercriminals. Europol announced the results of the campaign, known as Operation PowerOFF, on Thursday, describing it as an ongoing crackdown targeting the ecosystem of DDoS-for-hire services.
The operation resulted in the dismantling of servers, databases, and other infrastructure underpinning so-called booter and IP stressor services — tools used to flood websites, servers, and networks with junk traffic to render legitimate services inaccessible. Beyond seizing hardware and domains, investigators extracted data on more than 3 million alleged criminal user accounts from the confiscated databases.
Warnings Sent, Search Results Scrubbed
Armed with data from those seized accounts, authorities dispatched more than 75,000 emails and letters to individuals who had used or were suspected of using these services, warning them to cease their activities. The outreach effort reflects a strategy of deterrence that goes beyond simply prosecuting operators — it attempts to discourage would-be users before they escalate their involvement.
Officials also executed 25 search warrants as part of the operation. In an effort to reduce the visibility of illicit services online, investigators worked to remove more than 100 URLs advertising DDoS-for-hire tools from search engine results. Authorities went a step further by creating targeted search engine advertisements aimed at young people who may be looking for such tools, redirecting their curiosity toward warnings about the legal consequences of launching cyberattacks.
What Makes These Services So Dangerous
Officials characterized DDoS-for-hire platforms as both prolific and dangerously accessible. Many of these services include step-by-step tutorials that enable individuals with limited technical knowledge to initiate attacks against organizations of their choosing.
"Attacks are often regionally focused, with users targeting servers and websites within their continent, and directed at a wide range of targets including online marketplaces, telecommunications providers and other web-based services," Europol stated in its official news release.
The motivations behind these attacks are varied. Europol noted that they range from simple curiosity to ideological drivers linked to hacktivism, as well as financially motivated goals such as extortion or disrupting the services of business competitors.
Participating Nations and Law Enforcement Partners
Operation PowerOFF drew participation from a broad coalition of nations. The countries involved include the United States, United Kingdom, Australia, Austria, Belgium, Brazil, Bulgaria, Denmark, Estonia, Finland, Germany, Japan, Latvia, Lithuania, Luxembourg, the Netherlands, Norway, Poland, Portugal, Sweden, and Thailand.
The breadth of international cooperation underscores the recognition among law enforcement agencies that DDoS-for-hire services are a transnational threat requiring a unified response. The involvement of countries across Europe, the Asia-Pacific region, and the Americas highlights the truly global scale of the problem.
Part of a Larger, Continuing Campaign
This latest round of enforcement action is not an isolated event. The international crackdown previously disrupted several prominent DDoS-for-hire services in late 2024, resulting in three arrests and the takedown of 27 domains at that time.
More recently, authorities in Poland arrested four alleged administrators of DDoS-for-hire platforms in May. Those individuals are accused of facilitating thousands of attacks conducted between 2022 and 2025, illustrating just how entrenched and long-running some of these criminal operations have become.
Operation PowerOFF remains active, signaling that law enforcement agencies worldwide have no intention of letting up pressure on the individuals and services that make large-scale cyberattacks cheap, easy, and increasingly accessible to anyone with a grievance and an internet connection.
Source: CyberScoop