Loading story…
The U.S. Department of Justice, FBI Anchorage Field Office, and Royal Canadian Mounted Police seized court-authorized domains supporting NightmareStresser, a long-running DDoS-for-hire service. The action, conducted under the international Operation PowerOFF initiative, took the service offline after it had enabled hundreds of thousands of actual or attempted distributed denial-of-service attacks worldwide since 2022.
NightmareStresser allowed customers—often paying with cryptocurrency—to launch disruptive attacks without advanced technical skill. Its targets included educational institutions, government agencies, gaming platforms, and individual victims in the United States and other countries; organizations exposed to such services should maintain DDoS mitigation coverage, monitor for attack traffic, and preserve relevant evidence for law enforcement.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
A coordinated Operation PowerOFF action across 21 countries took down 53 domains, arrested four operators, and sent warning letters to more than 75,000 identified platform users.
An Operation PowerOFF sweep disrupted 27 DDoS-for-hire, or booter, websites.
The U.S. Department of Justice previously seized nightmare-stresser[.]com as part of an enforcement action that seized 48 domains associated with DDoS-for-hire services.
According to a seizure-warrant affidavit, NightmareStresser was used to conduct hundreds of thousands of actual or attempted DDoS attacks against victims worldwide beginning in 2022.
The FBI Anchorage Field Office, assisted by the Royal Canadian Mounted Police Federal Policing Northwest Region, seized court-authorized domains associated with the NightmareStresser DDoS-for-hire service under Operation PowerOFF. The action disrupted infrastructure used to let paying customers launch attacks against targets in Alaska, the United States, and worldwide.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcehelpnetsecurity.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. and international law enforcement agencies expanded **Operation PowerOFF** by seizing additional domains tied to DDoS-for-hire, or **booter/stressor**, services used to launch distributed denial-of-service attacks on demand. The U.S. Department of Justice said the FBI took control of 13 more domains linked to prolific platforms, including services that had resurfaced after an earlier disruption of 48 booter sites. Investigators found the platforms had amassed **hundreds of thousands of registered users** and had been used against school districts, government websites, businesses, and other targets; FBI testing on government-controlled systems showed some attacks were strong enough to completely cut off internet connectivity. The takedowns build on years of coordinated enforcement that has included the seizure of 15 booter websites, action against users of major DDoS-for-hire platforms, and prosecutions of operators tied to services such as **RoyalStresser.com**, **SecurityTeam.io**, **Astrostress.com**, and **Booter.sx**. Europol says the long-running campaign targets services that sell attacks for as little as **EUR 10**, lowering the barrier for low-skilled offenders and sometimes supporting broader criminal activity, including ransomware operations. The effort has involved the FBI, Europol, the U.K. National Crime Agency, Dutch police, and other global partners, alongside prevention campaigns aimed at deterring would-be users.
Jun 29, 2026
An international law enforcement campaign under **Operation PowerOFF** has repeatedly dismantled major **DDoS-for-hire** or **booter/stresser** services, seizing domains and infrastructure, arresting alleged administrators, and targeting customers across dozens of countries. In one major phase, authorities shut down **48 services** and arrested **seven** suspected operators after U.S. charges tied defendants to platforms including `Booter.sx`, `Astrostress.com`, and `SecurityTeam.io`; officials said one seized service alone had been used in more than **30 million attacks**. A later coordinated action involving the United States and about **20 partner countries** seized **53 domains**, made **four arrests**, executed **25 search warrants**, and sent more than **75,000 warning messages** to users, while also removing more than **100 URLs** advertising booter sites. The crackdown builds on earlier takedowns such as the seizure of **Webstresser.org**, which Europol described as the world’s largest DDoS-for-hire marketplace, with more than **136,000 registered users** and **4 million attacks** recorded before it was dismantled. Investigators said these services marketed themselves as legitimate network testing tools but were used to launch attacks against **schools, government agencies, gaming platforms, critical infrastructure, Department of Defense resources, businesses, and individuals**, often for as little as **EUR 15 per month**. Authorities also expanded disruption efforts beyond arrests and seizures by placing warning ads in search results and reaching users through cryptocurrency payment channels, underscoring a sustained multinational effort to raise the cost of operating and buying low-barrier DDoS attack services.
Aug 14, 2026
Authorities from 21 countries carried out a coordinated Operation PowerOFF crackdown against **DDoS-for-hire** infrastructure, dismantling booter services used to launch attacks against online marketplaces, telecommunications providers, and other internet-facing services. The action resulted in **53 domain takedowns**, **4 arrests**, and **25 search warrants**, while investigators seized servers, infrastructure, and databases tied to the illegal platforms. Data recovered during the operation helped investigators identify **more than 3 million criminal user accounts**, and law enforcement sent **over 75,000 warning emails and letters** to suspected users. Europol said the services lowered the barrier to launching disruptive attacks for motives ranging from curiosity and hacktivism to extortion and anti-competitive activity; prevention measures also included removing **more than 100 URLs** advertising booter services from search results, posting blockchain warning messages, and updating the Operation PowerOFF website as the international enforcement effort continues.
Jun 29, 2026