Ethan Foltz, a 22-year-old from Oregon, has been charged with operating the RapperBot botnet, a DDoS-for-hire service responsible for conducting over 370,000 attacks globally since 2021. According to the U.S. Department of Justice (DoJ), Foltz was arrested following a raid on his residence on August 6, 2025, where authorities seized control of the botnet's infrastructure. The botnet has been linked to attacks on targets in over 80 countries, impacting government networks, tech companies, and a prominent social media platform. The DoJ described RapperBot as capable of generating peak DDoS traffic of over 6 Terabits per second. Foltz faces a maximum penalty of 10 years in prison if convicted of aiding and abetting computer intrusions. 'The scale and sophistication of RapperBot demonstrate the ongoing challenges faced by law enforcement in combating cybercrime,' stated a DoJ official.
RapperBot, also known as 'Eleven Eleven Botnet' and 'CowBot,' primarily targets Internet of Things (IoT) devices, including digital video recorders and Wi-Fi routers, through brute-force attacks exploiting SSH and Telnet vulnerabilities. The botnet's operational capabilities were first documented by cybersecurity firm Fortinet in August 2022, which noted its resemblance to the infamous Mirai and Satori botnets. Since its inception, RapperBot has been responsible for attacking over 18,000 unique victims, with the botnet comprising between 65,000 and 95,000 infected devices at any given time.
The technical mechanisms of RapperBot involve compromising vulnerable devices, which are then commanded to send large volumes of traffic to specified targets, effectively overwhelming their servers. 'The attacks executed by RapperBot often far exceed the expected capacity of typical servers,' a cybersecurity analyst explained. These DDoS attacks not only disrupt services but can also cause significant financial losses for affected organizations.
In light of these developments, the cybersecurity community is urging organizations to bolster their defenses against such botnets. Security experts recommend implementing robust password policies and regularly updating device firmware to mitigate vulnerabilities. 'It's crucial for organizations to remain vigilant and proactive in securing their networks against the increasing threat of DDoS attacks,' a cybersecurity expert commented. As investigations continue, authorities are working to dismantle any remaining infrastructure associated with the RapperBot botnet and prevent future cybercrime activities.
