Loading story…
Thai authorities arrested German national Noah Christopher in Bangkok over allegations that he operated the Fluxstress and Neldowner cybercrime-as-a-service platforms, which investigators say enabled customers worldwide to launch distributed denial-of-service attacks and pay with cryptocurrencies including Bitcoin. The arrest followed a years-long investigation involving Thai officials and German authorities, who allege Christopher ran the services from 2021 to 2025 while moving through Dubai, China, and later Thailand to evade capture.
Thai officials revoked Christopher's visa under Section 12(7) of the Immigration Act before taking him into custody, and he is now awaiting extradition to Germany, where authorities reportedly seek him on 74 cybercrime warrants tied to DDoS, ransomware, and hacker-for-hire activity. Investigators in Thailand are examining his computers for possible attacks against local organizations, while security experts warned that Fluxstress may still remain online and operational despite the arrest.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
After Christopher's arrest, regional cybercrime expert Jacob Sims said Fluxstress still appeared to be online and functioning despite the law enforcement action.
Following the arrest, Thai Immigration Bureau investigators began examining Christopher's computers for possible evidence of attacks against Thai businesses and organizations.
Thai police, with assistance tied to German authorities, arrested Noah Christopher in Bangkok over allegations that he operated DDoS-for-hire platforms linked to transnational cybercrime. He is awaiting extradition to Germany, where authorities reportedly seek him on 74 cybercrime warrants.
Thai authorities canceled Noah Christopher's visa under Section 12(7) of the Immigration Act as part of the cybercrime investigation and enforcement action against him.
Authorities allege German national Noah Christopher ran the cybercrime-as-a-service platforms Fluxstress and Neldowner from 2021 to 2025, enabling customers worldwide to launch DDoS attacks in exchange for cryptocurrencies including Bitcoin.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Thai authorities, acting on intelligence provided by the FBI, arrested Denis Obrezko, an alleged member of the Russia-linked threat group Void Blizzard, at a hotel in Phuket on November 6. The operation, conducted jointly by the FBI and Thai police, resulted in the seizure of multiple electronic devices, including laptops, mobile phones, and cryptocurrency wallets. Obrezko, who had entered Thailand on October 30, was detained in Bangkok's Criminal Court pending extradition to the United States, with the Russian embassy confirming the arrest and considering consular assistance. Obrezko is suspected of having previously breached security systems and attacked government agencies in both Europe and the United States. The arrest was made after authorities received information that he was targeting Thailand, and an arrest warrant was obtained based on a U.S. extradition request. The U.S. Department of Justice has not yet commented on the case, while Russian officials have acknowledged the detention and are monitoring the situation.
Jun 29, 2026
An international law enforcement campaign under **Operation PowerOFF** has repeatedly dismantled major **DDoS-for-hire** or **booter/stresser** services, seizing domains and infrastructure, arresting alleged administrators, and targeting customers across dozens of countries. In one major phase, authorities shut down **48 services** and arrested **seven** suspected operators after U.S. charges tied defendants to platforms including `Booter.sx`, `Astrostress.com`, and `SecurityTeam.io`; officials said one seized service alone had been used in more than **30 million attacks**. A later coordinated action involving the United States and about **20 partner countries** seized **53 domains**, made **four arrests**, executed **25 search warrants**, and sent more than **75,000 warning messages** to users, while also removing more than **100 URLs** advertising booter sites. The crackdown builds on earlier takedowns such as the seizure of **Webstresser.org**, which Europol described as the world’s largest DDoS-for-hire marketplace, with more than **136,000 registered users** and **4 million attacks** recorded before it was dismantled. Investigators said these services marketed themselves as legitimate network testing tools but were used to launch attacks against **schools, government agencies, gaming platforms, critical infrastructure, Department of Defense resources, businesses, and individuals**, often for as little as **EUR 15 per month**. Authorities also expanded disruption efforts beyond arrests and seizures by placing warning ads in search results and reaching users through cryptocurrency payment channels, underscoring a sustained multinational effort to raise the cost of operating and buying low-barrier DDoS attack services.
Aug 14, 2026
U.S. prosecutors charged Russian national **Denis Nikolayevich Obrezko** with conspiracy to commit unauthorized computer access for allegedly providing infrastructure used by the Kremlin-linked espionage group **Void Blizzard**, also tracked as **Laundry Bear**. After his transfer from Thailand to Boston, Obrezko appeared in federal court over accusations that he bought a virtual private server and internet domains through cryptocurrency transactions that enabled intrusions against U.S. and foreign targets. Thai authorities arrested him in Phuket during a joint operation with the FBI and seized laptops, mobile phones, and cryptocurrency wallets. An unsealed FBI affidavit says investigators confirmed compromises at **11 U.S. companies** between June and July 2024, while assessing that the real number of victims is likely higher. Authorities and researchers said Void Blizzard has targeted government, defense, transportation, media, healthcare, educational institutions, NGOs, critical infrastructure, and organizations across Europe, North America, NATO countries, and Ukraine, using stolen credentials, session tokens, VPNs, and U.S.-based proxy services to evade detection. The group has also been linked to spear-phishing with typosquatted Microsoft-themed domains such as `miscrsosoft[.]com` and `micsrosoftonline[.]com`, and to theft of Dutch police staff contact information.
Jun 29, 2026