A 22-year-old Oregon man has been arrested on suspicion of working “Rapper Bot,” an enormous botnet used to energy a service for launching distributed denial-of-service (DDoS) assaults in opposition to targets — together with a March 2025 DDoS that knocked Twitter/X offline. The Justice Division asserts the suspect and an unidentified co-conspirator rented out the botnet to on-line extortionists, and tried to remain off the radar of regulation enforcement by guaranteeing that their botnet was by no means pointed at KrebsOnSecurity.
The management panel for the Rapper Bot botnet greets customers with the message “Welcome to the Ball Pit, Now with fridge help,” an obvious reference to a handful of IoT-enabled fridges that had been enslaved of their DDoS botnet.
On August 6, 2025, federal brokers arrested Ethan J. Foltz of Springfield, Ore. on suspicion of working Rapper Bot, a globally dispersed assortment of tens of 1000’s of hacked Web of Issues (IoT) gadgets.
The grievance in opposition to Foltz explains the assaults often clocked in at greater than two terabits of junk information per second (a terabit is one trillion bits of knowledge), which is greater than sufficient site visitors to trigger critical issues for all however essentially the most well-defended targets. The federal government says Rapper Bot constantly launched assaults that had been “lots of of instances bigger than the anticipated capability of a typical server positioned in a knowledge middle,” and that a few of its largest assaults exceeded six terabits per second.
Certainly, Rapper Bot was reportedly accountable for the March 10, 2025 assault that brought on intermittent outages on Twitter/X. The federal government says Rapper Bot’s most profitable and frequent prospects had been concerned in extorting on-line companies — together with quite a few playing operations based mostly in China.
The prison grievance was written by Elliott Peterson, an investigator with the Protection Prison Investigative Service (DCIS), the prison investigative division of the Division of Protection (DoD) Workplace of Inspector Common. The grievance notes the DCIS bought concerned as a result of a number of Web addresses maintained by the DoD had been the goal of Rapper Bot assaults.
Peterson mentioned he tracked Rapper Bot to Foltz after a subpoena to an ISP in Arizona that was internet hosting one of many botnet’s management servers confirmed the account was paid for by way of PayPal. Extra authorized course of to PayPal revealed Foltz’s Gmail account and beforehand used IP addresses. A subpoena to Google confirmed the defendant searched safety blogs always for information about Rapper Bot, and for updates about competing DDoS-for-hire botnets.
In line with the grievance, after having a search warrant served on his residence the defendant admitted to constructing and working Rapper Bot, sharing the income 50/50 with an individual he claimed to know solely by the hacker deal with “Slaykings.” Foltz additionally shared with investigators the logs from his Telegram chats, whereby Foltz and Slaykings mentioned how greatest to remain off the radar of regulation enforcement investigators whereas their rivals had been getting busted.
Particularly, the 2 hackers chatted about a Could 20 assault in opposition to KrebsOnSecurity.com that clocked in at greater than 6.3 terabits of knowledge per second. The transient assault was notable as a result of on the time it was the biggest DDoS that Google had ever mitigated (KrebsOnSecurity sits behind the safety of Undertaking Protect, a free DDoS protection service that Google offers to web sites providing information, human rights, and election-related content material).
The Could 2025 DDoS was launched by an IoT botnet referred to as Aisuru, which I found was operated by a 21-year-old man in Brazil named Kaike Southier Leite. This particular person was extra generally identified on-line as “Forky,” and Forky instructed me he wasn’t afraid of me or U.S. federal investigators. Nonetheless, the grievance in opposition to Foltz notes that Forky’s botnet appeared to decrease in dimension and firepower on the similar time that Rapper Bot’s an infection numbers had been on the upswing.
“Each FOLTZ and Slaykings had been very dismissive of consideration searching for actions, essentially the most excessive of which, of their view, was to launch DDoS assaults in opposition to the web site of the distinguished cyber safety journalist Brian Krebs,” Peterson wrote within the prison grievance.
“You see, they’ll get themselves [expletive],” Slaykings wrote in response to Foltz’s feedback about Forky and Aisuru bringing an excessive amount of warmth on themselves.
“Prob cuz [redacted] hit krebs,” Foltz wrote in reply.
“Going in opposition to Krebs isn’t transfer,” Slaykings concurred. “It isn’t about being a [expletive] or afraid, you simply get quite a lot of issues for zero cash. Infantile, however good. Allow them to die.”
“Ye, it’s good tho, they’ll die,” Foltz replied.
The federal government states that simply previous to Foltz’s arrest, Rapper Bot had enslaved an estimated 65,000 gadgets globally. That will sound like lots, however the grievance notes the defendants weren’t desirous about making headlines for constructing the world’s largest or strongest botnet.
Fairly the opposite: The grievance asserts that the accused took care to keep up their botnet in a “Goldilocks” dimension — guaranteeing that “the variety of gadgets afforded highly effective assaults whereas nonetheless being manageable to regulate and, within the hopes of Foltz and his companions, sufficiently small to not be detected.”
The grievance states that a number of days later, Foltz and Slaykings returned to discussing what that they anticipated to befall their rival group, with Slaykings stating, “Krebs could be very revenge. He gained’t cease till they’re [expletive] to the bone.”
“Stunned they’ve any bots left,” Foltz answered.
“Krebs will not be the one you need to have in your again. Not as a result of he’s scary or one thing, simply because he won’t hand over UNTIL you’re [expletive] [expletive]. Proved it with Mirai and plenty of different circumstances.”
[Unknown expletives aside, that may well be the highest compliment I’ve ever been paid by a cybercriminal. I might even have part of that quote made into a t-shirt or mug or something. It’s also nice that they didn’t let any of their customers attack my site — if even only out of a paranoid sense of self-preservation.]
Foltz admitted to wiping the person and assault logs for the botnet roughly as soon as per week, so investigators had been unable to tally the full variety of assaults, prospects and targets of this huge crime machine. However the information that was nonetheless out there confirmed that from April 2025 to early August, Rapper Bot carried out over 370,000 assaults, focusing on 18,000 distinctive victims throughout 1,000 networks, with the majority of victims residing in China, Japan, america, Eire and Hong Kong (in that order).
In line with the federal government, Rapperbot borrows a lot of its code from fBot, a DDoS malware pressure also referred to as Satori. In 2020, authorities in Northern Eire charged a then 20-year-old man named Aaron “Vamp” Sterritt with working fBot with a co-conspirator. U.S. prosecutors are nonetheless searching for Sterritt’s extradition to america. fBot is itself a variation of the Mirai IoT botnet that has ravaged the Web with DDoS assaults since its supply code was leaked again in 2016.
The grievance says Foltz and his accomplice didn’t permit most prospects to launch assaults that had been greater than 60 seconds in period — one other manner they tried to maintain public consideration to the botnet at a minimal. Nonetheless, the federal government says the proprietors additionally had particular preparations with sure high-paying purchasers that allowed a lot bigger and longer assaults.
The accused and his alleged accomplice made mild of this weblog submit in regards to the fallout from one among their botnet assaults.
Most individuals who’ve by no means been on the receiving finish of a monster DDoS assault don’t know of the fee and disruption that such sieges can carry. The DCIS’s Peterson wrote that he was in a position to check the botnet’s capabilities whereas interviewing Foltz, and that discovered that “if this had been a server upon which I used to be working an internet site, utilizing companies similar to load balancers, and paying for each outgoing and incoming information, at estimated business common charges the assault (2+ Terabits per second instances 30 seconds) might need value the sufferer wherever from $500 to $10,000.”
“DDoS assaults at this scale usually expose victims to devastating monetary impression, and a possible various, community engineering options that mitigate the anticipated assaults similar to overprovisioning, i.e. growing potential Web capability, or DDoS protection applied sciences, can themselves be prohibitively costly,” the grievance continues. “This ‘rock and a tough place’ actuality for a lot of victims can go away them acutely uncovered to extortion calls for – ‘pay X {dollars} and the DDoS assaults cease’.”
The Telegram chat data present that the day earlier than Peterson and different federal brokers raided Foltz’s residence, Foltz allegedly instructed his accomplice he’d discovered 32,000 new gadgets that had been susceptible to a beforehand unknown exploit.
Foltz and Slaykings discussing the invention of an IoT vulnerability that can give them 32,000 new gadgets.
Shortly earlier than the search warrant was served on his residence, Foltz allegedly instructed his accomplice that “As soon as once more we’ve the most important botnet locally.” The next day, Foltz instructed his accomplice that it was going to be a terrific day — the most important to this point when it comes to revenue generated by Rapper Bot.
“I sat subsequent to Foltz whereas the messages poured in — guarantees of $800, then $1,000, the proceeds ticking up because the day went on,” Peterson wrote. “Noticing a change in Foltz’ habits and anxious that Foltz was making modifications to the botnet configuration in actual time, Slaykings requested him ‘What’s up?’ Foltz deftly typed out some fast responses. Reassured by Foltz’ reply, Slaykings responded, ‘Okay, I’m the paranoid one.”
The case is being prosecuted by Assistant U.S. Lawyer Adam Alexander within the District of Alaska (no less than a number of the gadgets discovered to be contaminated with Rapper Bot had been positioned there, and it’s the place Peterson is stationed). Foltz faces one depend of aiding and abetting laptop intrusions. If convicted, he faces a most penalty of 10 years in jail, though a federal decide is unlikely to award wherever close to that sort of sentence for a first-time conviction.
