An Oregon resident has been charged in federal court in Alaska for allegedly operating the “Rapper Bot” DDoS-for-hire botnet, which authorities say has carried out widespread cyber-attacks since 2021.
Court documents identify Ethan Foltz, 22, of Eugene, Oregon, as the alleged administrator of Rapper Bot. The botnet—also known as “Eleven Eleven Botnet” and “CowBot”—reportedly infects devices such as digital video recorders and WiFi routers with malware. Customers would then use these compromised devices to launch distributed denial-of-service (DDoS) attacks against targets worldwide.
According to investigators, Foltz and others are accused of monetizing Rapper Bot by selling access to its services. Authorities allege that the botnet targeted victims in over 80 countries, including a U.S. government network, a social media platform, and several U.S. technology companies. From April 2025 onward, Rapper Bot is said to have conducted more than 370,000 attacks on approximately 18,000 unique victims.
The complaint states that the botnet operated using between 65,000 and 95,000 infected devices at any given time and often generated attack traffic between two and three terabits per second. The largest reported attack may have exceeded six terabits per second. Investigators believe at least five infected devices were located in Alaska.
Authorities note that DDoS attacks can cause significant financial harm through lost revenue and increased costs for bandwidth and mitigation efforts. Attacks of this scale can cost victims from $500 to $10,000 for just thirty seconds of disruption. Some customers allegedly used the threat of DDoS attacks to extort money from victims.
On August 6, law enforcement executed a search warrant at Foltz’s residence in Oregon. Officials say they shut down Rapper Bot’s operations and took control of its infrastructure. Since transferring control to the Defense Criminal Investigative Service (DCIS), no new attacks attributed to Rapper Bot have been reported by private sector partners.
“Rapper Bot was one of the most powerful DDoS botnets to ever exist, but the outstanding investigatory work by DCIS cyber agents and support of my office and industry partners has put an end to Foltz’s time as administrator and effectively disrupted the activities of this transnational criminal group,” said U.S. Attorney Michael J. Heyman for the District of Alaska. “Our office remains committed to disrupting and dismantling cyber criminals that threaten internet security and infrastructure in the District of Alaska and across the United States.”
“Today’s announcement highlights the ongoing efforts by law enforcement to disrupt and dismantle emerging cyber threats targeting the Department of Defense and the defense industrial base,” said Special Agent in Charge Kenneth DeChellis of the Department of Defense Office of Inspector General, DCIS, Cyber Field Office. “The Rapper Bot malware was a clear threat, and the focused efforts of DCIS, our industry partners, and the federal prosecutors at the U.S. Attorney’s Office in Alaska, sends a clear signal to those who would harm the DoD’s personnel, infrastructure, and intellectual property, that their actions will come at a cost.”
Foltz faces one count of aiding and abetting computer intrusions with a maximum possible sentence of ten years if convicted; sentencing will be determined by a federal judge following consideration under sentencing guidelines.
The case is being investigated by DCIS with help from agencies including Akamai Technologies Inc., Amazon Web Services Inc., Cloudflare Inc., Digital Ocean LLC., Flashpoint Intelligence LLC., Google LLC., PayPal Holdings Inc., Unit 221B LLC., Operation PowerOFF—a coordinated international effort against criminal DDoS-for-hire operations—and assistance from both U.S. Attorneys’ Offices in Alaska and Oregon.
Assistant U.S. Attorney Adam Alexander is prosecuting this case.
A criminal complaint is only an allegation; all defendants are presumed innocent until proven guilty beyond a reasonable doubt in court.
