FBI seizes NightmareStresser domains linked to hundreds of thousands of DDoS attacks

US authorities have seized domains behind the NightmareStresser DDoS-for-hire service, accused of facilitating hundreds of thousands of attacks worldwide.

Key takeaways

• The FBI seized domains associated with the NightmareStresser DDoS-for-hire service
• Authorities say the platform facilitated hundreds of thousands of actual or attempted DDoS attacks since 2022
• Research from 2023 identified more than 566,000 registered users and 52 servers
• The takedown is part of the international Operation PowerOFF campaign against DDoS-for-hire services

FBI disrupts long-running NightmareStresser service

US authorities have disrupted NightmareStresser, a long-running DDoS-for-hire service accused of enabling attacks against organizations and other targets around the world. The Justice Department said the FBI seized two domains associated with the platform under court authorization on Sept. 15.

According to the seizure warrant affidavit, NightmareStresser had been used in hundreds of thousands of actual or attempted distributed denial-of-service attacks since 2022, including attacks affecting schools, government agencies and gaming platforms worldwide. DDoS attacks flood a website, server or network with traffic to the point legitimate users can no longer reach it.

DDoS attacks became a service for sale

Services marketed as “booters” or “stressers” lower the barrier to carrying out such attacks because customers can pay for access instead of building the necessary infrastructure themselves. The FBI says using these services to attack systems without authorization is illegal and can lead to criminal charges.

NightmareStresser was not a small operation. Research published by Searchlight Cyber in 2023 found more than 566,000 registered users, 52 servers and 28 attack methods. The platform let customers specify an IP address or URL, choose ports and launch attacks across transport and application layers. Searchlight said advertised packages ranged from €25 to €19,999, with apparent attack capacity reaching 200 Gbps.

Operation PowerOFF keeps targeting DDoS infrastructure

The seizure is part of Operation PowerOFF, an international law-enforcement campaign focused on dismantling DDoS-for-hire infrastructure and pursuing operators and users. The FBI’s Anchorage Field Office coordinated the NightmareStresser action with the Royal Canadian Mounted Police. Related investigations in Anchorage and Los Angeles have led to charges against 12 defendants and more than 100 domain seizures over eight years.

For consumers, the case also highlights a less visible side of the DDoS economy: compromised computers, routers and other connected devices can become attack infrastructure without their owners realizing it. Keeping devices updated, replacing default passwords and retiring unsupported hardware can reduce exposure. Security software can also help detect malware and suspicious activity on supported endpoints, reducing the chance that a personal device is pulled into a wider botnet.

Keep your devices out of botnets

A DDoS attack against an online service cannot be stopped by antivirus software on your own computer. However, protecting personal devices against malware matters because compromised systems can be recruited into botnets without their owners knowing.

Bitdefender Ultimate Security provides antimalware protection and network threat prevention across supported personal devices, helping detect malicious activity that could otherwise leave them exposed to botnet abuse.