Authorities seized the primary domain and other websites linked to NightmareStresser, one of the longest-running and most popular distributed denial-of-service operations used by cybercriminals globally, the Justice Department said Tuesday. 

Cybercriminals of various motivations used the DDoS-for-hire service to launch hundreds of thousands of DDoS attacks or attempted attacks since at least 2022, officials said. 

The takedown, part of an ongoing globally coordinated effort dubbed “Operation PowerOFF,” marks law enforcement’s continued targeting of IP stressers or DDoS booters that inundate websites, servers and networks with junk traffic, rendering legitimate sites inaccessible. The seizures were executed by the FBI Anchorage field office and the Royal Canadian Mounted Police.

Officials didn’t name the operators of NightmareStresser or identify its country of origin, but the service claimed it operated under the laws of Russia, Zach Edwards, staff threat researcher at Infoblox told CyberScoop.

The court-ordered seizure of NightmareStresser’s primary domain, which operated openly on the public web and now displays a seizure notice, is a positive development in the fight against DDoS-for-hire threat actors, Edwards said. Yet, he added, “it’s somewhat shocking that it’s taken law enforcement this long to take action.”

Authorities said they’ve seized more than 100 domains associated with DDoS-for-hire services since 2018. 

Despite those efforts, DDoS-for-hire tools remain prolific and easily accessible, often including tutorials that allow non-tech savvy people to initiate attacks on various organizations. 

“The vast majority of people who actually use DDoS services like NightmareStresser are script kiddies, oftentimes for pranks or for some sort of obscure political agenda. These services have been heavily used against gaming servers and streamers,” Edwards said.

Officials said NightmareStresser’s customers targeted various victims in the United States and abroad, including educational institutions, government agencies, gaming platforms and millions of people.

The DDoS-for-hire service’s operators claimed tens of thousands of users, Edwards said. “NightmareStresser is unique because of how long they’ve operated, their aggressive marketing which was pretty open about supporting illegal use cases, and their affiliate program which was used to reward partners,” he added. 

Authorities are now likely attempting to identify the operators of NightmareStresser, its business partners and people who used the service, according to Edwards. 

“Unfortunately for law enforcement, threat actors behind NightmareStresser claimed they were operating under the laws of the Russian Federation, which is a strong sign that it may be challenging to bring these folks to justice, even if they are known and doxxed,” he said. 

The impact of the seizures may also be temporary, at best. “The reality is that these booter services are like playing a game of Whac-A-Mole,” Edwards said. “There’s always another suspicious service operating similar DDoS products, and these underground networks quickly shift to new providers when one is taken down.”

The post Authorities seize popular, long-running DDoS-for-hire service domains appeared first on CyberScoop.

The developers of a notorious botnet that’s powered mostly by hijacked Android TV boxes and other internet-connected devices have released a new version built to blend attack traffic in with ordinary web browsing and to keep its command channels from being seized by law enforcement, researchers at Palo Alto Networks said in a report published Tuesday.

The company’s Unit 42 threat intelligence group, which tracks the botnet as Kimwolf or Aisuru, said the newest version has been active since February, a month before authorities seized infrastructure powering previous versions of the botnet. 

The biggest change, according to the report, is a new flood method built on HTTP/2, the protocol that carries most web traffic today. A flood is the crude heart of a DDoS attack: thousands of infected devices send a target far more requests than it can answer. Rather than fire raw packets, this latest Kimwolf version operates with full browser fingerprints, copying the header order and behavior of the Chrome web browser. That matters because the usual defense against a flood is for tools to spot the fake traffic and drop or block it before it reaches the server. Traffic that looks like Chrome does not get dropped, so a site under attack must either serve every request and fall over, or start turning away the customers it cannot tell apart from the bots.

The second change, according to researchers, looks like it was done to withstand further takedowns. Every bot has to ask a command server for orders, which is also what authorities aim to disrupt in botnet takedowns. Normally, the command server address sits inside the malware as a web domain name, so investigators who take that name from its registrar are able to disrupt an entire botnet. 

This Kimwolf version moves its command beyond registrar controls. The malware now looks up its command address in the Ethereum Name Service, a directory that lives on the Ethereum blockchain. A web address using this service can display the way a normal domain does, but the domain’s record sits in a ledger copied across thousands of computers worldwide. The malware carries five public Ethereum services and shuffles the order before each attempt, making it harder for defensive tools to block. Additionally, there is no company to serve with a law enforcement order and no domain record to seize.

Additionally, if all five addresses fail, the botnet falls back to a fixed Tor hidden service address written into the code. Tor resolves that address through its own network rather than the ordinary domain system, and it hides where the server actually sits, which leaves investigators without a host to contact.

Researchers’ infrastructure analysis pointed to the machines powering the command structure to be located in Russia. Four of these servers shared a SSH host key, with further analysis finding that the servers sit in one network registered in Saint Petersburg.

It’s unclear if this version was made by people behind previous iterations of the botnet, or a new person or threat group looking to capitalize on the botnet’s notoriety among malicious actors. 

Unit 42 did not respond to CyberScoop’s request for comment. 

Kimwolf, which splintered off from the record-setting Aisuru DDoS botnet last year, gained the widespread attention of security researchers when it temporarily claimed the top spot in Cloudflare’s global domain rankings in late October 2025. Previous versions of the botnet were disrupted by an international law enforcement operation in March that ended with Kimwolf’s infrastructure being seized.

A Canadian man alleged to run the botnet was arrested in May and extradited to the United States.
  

The post Kimwolf botnet rebuilt to survive takedowns, researchers say appeared first on CyberScoop.