Operation PowerOFF disrupts DDoS-for-hire platforms and arrests administrators

An international law enforcement campaign under Operation PowerOFF has repeatedly dismantled major DDoS-for-hire or booter/stresser services, seizing domains and infrastructure, arresting alleged administrators, and targeting customers across dozens of countries. In one major phase, authorities shut down 48 services and arrested seven suspected operators after U.S. charges tied defendants to platforms including Booter.sx, Astrostress.com, and SecurityTeam.io; officials said one seized service alone had been used in more than 30 million attacks. A later coordinated action involving the United States and about 20 partner countries seized 53 domains, made four arrests, executed 25 search warrants, and sent more than 75,000 warning messages to users, while also removing more than 100 URLs advertising booter sites.

The crackdown builds on earlier takedowns such as the seizure of Webstresser.org, which Europol described as the world’s largest DDoS-for-hire marketplace, with more than 136,000 registered users and 4 million attacks recorded before it was dismantled. Investigators said these services marketed themselves as legitimate network testing tools but were used to launch attacks against schools, government agencies, gaming platforms, critical infrastructure, Department of Defense resources, businesses, and individuals, often for as little as EUR 15 per month. Authorities also expanded disruption efforts beyond arrests and seizures by placing warning ads in search results and reaching users through cryptocurrency payment channels, underscoring a sustained multinational effort to raise the cost of operating and buying low-barrier DDoS attack services.