[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f12XRwJmaeDlFgYV8EgCVcuWxo4KPss57kdNY5qPNYmE":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"72d751ca-03b0-4c4b-a000-a8a341e68bf4","Authorities seize popular, long-running DDoS-for-hire service domains","authorities-seize-popular-long-running-ddos-for-hire-service-domains-09d9e8","Cybercriminals used NightmareStresser to launch hundreds of thousands of DDoS attacks since at least 2022. Threat actors behind the operation claimed links to Russia. The post Authorities seize popular, long-running DDoS-for-hire service domains appeared first on CyberScoop.","Law enforcement agencies, including the FBI and Royal Canadian Mounted Police, have seized the primary domain and associated websites of NightmareStresser, a long-running distributed denial-of-service (DDoS) for-hire service. The operation, dubbed 'Operation PowerOFF,' targeted a service used by cybercriminals since at least 2022 to launch hundreds of thousands of attacks against various targets globally. While operators claimed to operate under Russian law, making potential prosecution challenging, the takedown highlights ongoing efforts against such services.","Authorities seize domains of NightmareStresser, a popular DDoS-for-hire service with alleged Russian ties.","https:\u002F\u002Fcyberscoop.com\u002Ffbi-seizes-nightmarestresser-ddos-for-hire-domains\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F09\u002FGettyImages-2256333099.jpg","2026-09-17T13:37:23+00:00","2026-09-17T14:00:27.784869+00:00",7,[17,20],{"name":18,"type":19},"NightmareStresser","threat_actor",{"name":21,"type":22},"Operation PowerOFF","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[],[],{"controls":44,"vendors":129},[45,74,100],{"slug":46,"name":47,"problem":48,"products":49},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"slug":75,"name":76,"problem":77,"products":78},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[79,84,92],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":80,"product_name":81,"url":82,"description":83},"cloudflare-waf","Cloudflare WAF and DDoS protection","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fwaf\u002F","Web application firewall and unmetered DDoS mitigation for websites and APIs.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",{"slug":101,"name":102,"problem":103,"products":104},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[],{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":143},"ddos-for-hire-service-seized-in-international-law-enforcement-operation","DDoS-for-Hire Service Seized in International Law Enforcement Operation","NightmareStresser operated as a commercialized cybercrime service, lowering the barrier for unskilled attackers to launch large-scale DDoS attacks against organizations worldwide. The root problem is the existence of a gray-market economy that profits from enabling disruption, compounded by jurisdictional challenges when operators shelter behind foreign legal systems. This case underscores that even when criminal services operate in permissive legal environments, coordinated international law enforcement can still disrupt and seize infrastructure. Organizations that were targeted suffered real operational harm, highlighting why proactive DDoS defense posture—not just reactive reporting—is essential.",[135,136,137,138,139,140,141,142],"NIST SP 800-61 Rev. 2 – Incident Response","NIST SP 800-189 – Resilient Interdomain Traffic Exchange (DDoS guidance)","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","NIST IR-4 – Incident Handling","NIST SI-3 \u002F SI-10 – Traffic and Input Protection","GDPR Article 32 – Security of Processing (availability and resilience obligation)","ITIL Service Continuity Management – DDoS as a continuity threat scenario",{"NIST IR-4 – Incident Handling":144,"NIST SP 800-61 Rev. 2 – Incident Response":145,"CIS Control 17 – Incident Response Management":146,"CIS Control 13 – Network Monitoring and Defense":147,"NIST SI-3 \u002F SI-10 – Traffic and Input Protection":148,"NIST SP 800-189 – Resilient Interdomain Traffic Exchange (DDoS guidance)":149,"ITIL Service Continuity Management – DDoS as a continuity threat scenario":150,"GDPR Article 32 – Security of Processing (availability and resilience obligation)":151},"Incident handling covers coordinating with ISPs and law enforcement during DDoS attacks.","Incident response planning helps organisations respond to DDoS attacks launched via services like NightmareStresser.","Incident response management includes DDoS playbooks and contacts with providers and law enforcement.","Network monitoring helps detect DDoS traffic early so mitigation can begin.","Traffic and input protections, such as filtering and rate limiting, help absorb attacks bought from stresser services.","Resilient traffic exchange guidance, such as source address validation, reduces the spoofed traffic stresser services rely on.","Treating DDoS as a continuity scenario ensures services can be maintained or restored during attacks.","Resilience and availability obligations require planning for DDoS attacks against services processing personal data."]