Operation PowerOFF: 75,000 DDoS-for-Hire Service Users Identified and Warned

Key Findings

• Law enforcement from 21 countries completed a major crackdown on DDoS-for-hire services on April 13, 2026, resulting in 4 arrests and seizure of 53 web domains

• Over 75,000 warning letters and emails were sent to users of illegal DDoS services, targeting young people and hobbyists

• Authorities identified details on more than 3 million criminal user accounts during the investigation

• Operation PowerOFF deployed innovative enforcement tactics including Google ads and blockchain payment tracking to deter participation

Background

DDoS-for-hire services, commonly called boosters or stressers, have become one of the most accessible entry points into cybercrime. These platforms allow anyone with minimal technical knowledge to launch Distributed Denial-of-Service attacks for minimal fees by following simple step-by-step tutorials. The attacks render servers, websites, and online services unavailable to legitimate users, causing significant damage to businesses and individuals globally. Operation PowerOFF represents a coordinated international effort spanning 21 countries to dismantle this infrastructure and educate potential offenders about the serious legal consequences.

The Scale of the Problem

The sheer volume of users discovered during this operation underscores how widespread DDoS-for-hire services have become. With over 3 million criminal accounts identified, authorities realized that traditional enforcement alone would not solve the problem. This led to a dual approach: pursuing the operators and platform creators while simultaneously targeting the user base through mass notification campaigns. The warnings serve a preventative function, particularly aimed at younger participants who may not fully understand the criminal nature of their actions.

Innovative Enforcement Tactics

Rather than relying solely on arrests and domain seizures, Operation PowerOFF deployed creative deterrence strategies. Law enforcement placed advertisements on Google search results to intercept users actively seeking these services, replacing expected links with official warnings. Additionally, investigators tracked cryptocurrency payments across blockchain networks to identify and warn those attempting to pay for attacks using digital currency. These methods acknowledge that modern cybercriminals operate across digital platforms and attempt to meet them at the point of engagement.

Years of Persistent Operations

Operation PowerOFF represents the culmination of sustained law enforcement effort spanning multiple years. In 2018, authorities took down Webstresser.org, which had 136,000 users and facilitated 4 million attacks. Subsequent operations seized IPStresser.com in 2022 and targeted over a dozen additional domains in 2023 through the US Department of Justice. A 2024 coordinated action involving 15 countries shut down 27 more websites, with three arrests made in France and Germany. Polish authorities arrested four individuals in May 2025 running platforms where attacks cost as little as 10 euros. Most recently, in March 2026, agencies disabled four major botnet networks including Aisuru, KimWolf, JackSkid, and Mossad that supplied the traffic used in attacks.

Limitations and Future Challenges

Despite the scale of Operation PowerOFF, authorities acknowledge they cannot completely eliminate DDoS attacks. Seizing servers and databases disrupts operations but does not provide a permanent solution to the underlying demand. The goal remains to raise the barriers to entry, increase costs, and create awareness about legal consequences. By combining arrests, domain seizures, and mass notification campaigns, law enforcement aims to shift the risk calculation for potential users and make launching attacks significantly more difficult than it has been in previous years.

Sources

• https://hackread.com/operation-poweroff-ddos-for-hire-services-identified/

• https://x.com/HackRead/status/2045465364423647552

• https://www.bitdefender.com/en-us/blog/hotforsecurity/operation-poweroff-75-000-ddos-users

• https://www.linkedin.com/posts/garettm_operation-poweroff-75k-users-of-ddos-for-hire-activity-7451239399226314752-8FdY

• https://www.reddit.com/r/pwnhub/comments/1sp3tph/operation_poweroff_75k_users_of_ddosforhire/