A 22-year-old Oregon man has been charged with administering the Rapper Bot DDoS-for-hire botnet, which was allegedly used to launch multi-terabit attacks across 80+ countries.
Rapper Bot is alleged to administer large-scale DDoS-for-hire attacks averaging two to three terabits (Tb) in size and targeting victims in over 80 countries, according to a 19 August update by the US Attorney’s Office, District of Alaska.
Foltz is charged with one count of aiding and abetting computer intrusions. If convicted, he faces a maximum penalty of 10 years in prison.
The botnet primarily compromises devices like Digital Video Recorders (DVRS) or WiFi routers at scale by infecting those devices with specialized malware.
Clients of Rapper Bot then issue commands to those infected victim devices, forcing them to send large volumes of DDoS traffic to different victim computers and servers located throughout the world.
The alleged administrator, Ethan Foltz, is accused of monetizing Rapper Bot by providing select paying customers with access to one of the most sophisticated and powerful DDoS-for-hire botnets currently in existence.
Read more: Cloudflare Blocks Record-Breaking 7.3 Tbps DDoS Attack
Rapper Bot Accused of Launching Attacks Exceeding 6 Tbps
The criminal complaint details that partner data showed that from April 2025 to present, Rapper Bot allegedly conducted over 370,000 attacks, targeting 18,000 unique victims.
Rapper Bot was allegedly utilizing roughly 65,000 to 95,000 infected victim devices to regularly conduct DDoS attacks that often measured between two to three Tb per second (Tbps).
The largest attacks may have exceeded six Tbps.
“Rapper Bot was one of the most powerful DDoS botnets to ever exist, but the outstanding investigatory work by Defense Criminal Investigative Service (DCIS) cyber agentsand support of my office and industry partners has put an end to Foltz’s time as administrator and effectively disrupted the activities of this transnational criminal group,” US Attorney Michael J. Heyman for the District of Alaska said.
Victims Extorted, Impacted Financially
Court documents outlined that victims of the powerful DDoS attacks were impacted through lost revenue, disgruntled customers, resources used to respond to attacks and bandwidth usage costs.
A DDoS attack averaging over two Tbps lasting 30 seconds might cost a victim anywhere from $500 to $10,000, according to the criminal complaint.
It is also alleged that some Rapper Bot customers issued extortion demands, leveraging DDoS attacks to extort payments from victims.
Victims of the botnet included a US government network, a popular social media platform and multiple US tech companies.
Special Agent in Charge, Kenneth DeChellis of the Department of Defense Office of Inspector General, DCIS, Cyber Field Office, noted that the announcement of charges against Foltz highlights ongoing efforts by law enforcement to disrupt and dismantle emerging cyber threats targeting the Department of Defense and the defense industrial base.
“The Rapper Bot malware was a clear threat, and the focused efforts of DCIS, our industry partners, and the federal prosecutors at the US Attorney’s Office in Alaska, sends a clear signal to those who would harm the DoD’s personnel, infrastructure and intellectual property, that their actions will come at a cost,” he said.