CyberHappenings logo
☰
🏠 Home 📂 Browse ℹ️ About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

RapperBot Botnet Disrupted and Administrator Charged

First reported
Last updated
📰 2 unique sources, 2 articles

Summary

Hide ▲

A 22-year-old man from Eugene, Oregon, Ethan Foltz, has been charged with developing and operating the RapperBot botnet, which conducted over 370,000 DDoS attacks against 18,000 unique victims across 80 countries since 2021. The botnet, also known as Eleven Eleven Botnet and CowBot, targeted Digital Video Recorders (DVRs) and Wi-Fi routers using SSH or Telnet brute-force attacks. In 2023, RapperBot added a cryptomining module to diversify its revenue stream. Foltz was arrested on August 6, 2025, and faces up to 10 years in prison if convicted. The botnet's command-and-control infrastructure was seized during the operation.

Timeline

  1. 20.08.2025 07:19 📰 2 articles · ⏱ 27d ago

    RapperBot Botnet Administrator Charged and Infrastructure Seized

    The botnet targeted U.S. government systems, major media platforms, gaming companies, and large tech firms. In 2023, RapperBot added a cryptomining module to diversify its revenue stream. The botnet launched 370,000 attacks since April 2025, with attacks ranging from several terabits to over 1 billion packets per second (pps). The cost of a DDoS attack averaging over two Terabits per second lasting 30 seconds might range from $500 to $10,000. Foltz was issued a summons following the filing of the criminal complaint and remains free.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

Cloudflare mitigates record 11.5 Tbps UDP flood DDoS attack

Cloudflare recently blocked the largest recorded volumetric DDoS attack, peaking at 11.5 Tbps. The attack was a UDP flood, primarily originating from a combination of several IoT and cloud providers, including Google Cloud, and lasted approximately 35 seconds. Volumetric DDoS attacks overwhelm targets with massive data, consuming bandwidth and exhausting resources. This attack is part of a recent surge in hyper-volumetric DDoS attacks, with Cloudflare autonomously blocking hundreds over the past few weeks. This attack follows a 7.3 Tbps DDoS attack in June 2025 and a 3.8 Tbps attack in October 2024, both mitigated by Cloudflare. The increase in DDoS attacks highlights the escalating threat landscape and the need for robust cybersecurity defenses. The attack involved the RapperBot botnet, which targets network video recorders (NVRs) and other IoT devices, exploiting security flaws to gain initial access and download the malware payload.

Open in new tab