FBI seizes NightmareStresser again, three years after the brand's first takedown

The Justice Department announced the court-authorized seizure of internet domains associated with NightmareStresser, described by the department as one of the world's longest running DDoS-for-hire services, in an announcement from the District of Alaska.

On Tuesday the FBI seized the domains used by NightmareStresser: nightmare-stresser[.]com and nightmarestresser[.]org.

According to the seizure warrant affidavit, the NightmareStresser booter service was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide since 2022.

The Justice Department said booter services named in the action allegedly facilitate attacks on victims including educational institutions, government agencies, gaming platforms and millions of people, and that the attacks can significantly degrade internet services and completely disrupt internet connections.

In April, a coordinated Operation PowerOFF action across 21 countries took down 53 domains, arrested four operators, and sent warning letters to more than 75,000 identified users of these platforms.

Impact from these attacks can extend beyond the intended target to other users and services relying on the same network infrastructure.

The Justice Department said the multi-prong investigation announced "builds on the success of the prior cases by targeting all known booter sites, shutting down as many as possible, and undertaking a public education campaign."

Searchlight Cyber reported in 2023 that NightmareStresser had 52 dedicated servers that could launch DDoS attacks of up to 200 Gbps against multiple network layers, including Layer 7 application protocols and Layer 4 TCP/UDP protocols.

In December 2022, the U.S. Department of Justice took down the nightmarestresser[.]com domain and arrested six suspects who allegedly owned multiple DDoS-for-hire services.

Booter services such as NightmareStresser let anyone rent large botnets of compromised routers and a wide range of IoT devices to launch DDoS attacks against online platforms and services.

In December 2024, an Operation PowerOFF sweep knocked out 27 booter sites in one action.

In other joint actions under Operation PowerOFF, law enforcement seized 13 domains and 48 more domains hosting booter platforms in two separate enforcement waves.

Before the takedown, the service described itself as the "#1 online IP booter" and "the only DDoS tool available 24/7."

Booter services are difficult to eliminate completely; when one is taken down, another can quickly appear.

Operation PowerOFF began in December 2018 with the seizure of 15 websites linked to DDoS-as-a-service platforms.

Last year, Polish authorities detained four suspects linked to six DDoS-for-hire platforms, and the United States seized nine domains in the same coordinated crackdown.

The Operation PowerOFF waves enumerated across the two reports account for at least 165 booter domains seized.

Renting a DDoS attack from a booter service cost a few dollars.

The domain seized in December 2022 and the two seized this week differ by a hyphen and a top-level domain.

Twelve defendants charged over eight years by Anchorage and Los Angeles prosecutors is about 1.5 defendants a year.

Searchlight Cyber reported in 2023 that NightmareStresser had over 566,000 registered users.

The more than 75,000 warning letters sent in April amount to roughly 13 percent of the registered accounts Searchlight Cyber counted on NightmareStresser alone in 2023.