A criminal operation offering DDoS-for-hire services has been shut down by Polish authorities, who arrested four individuals believed to be behind a network of illegal platforms responsible for thousands of cyber-attacks across the globe.
Europol said the suspects are accused of operating six separate stresser/booter services – Cfxapi, Cfxsecurity, neostress, jetstress, quickdown and zapcut – which enabled users to launch attacks against targets for as little as EUR 10.
These services were used to disrupt various systems, including schools, government websites, private businesses and online gaming platforms, between 2022 and 2025.
A key feature of the platforms was their user-friendly design for launching distributed denial-of-service (DDoS) attacks.
With no technical knowledge required, customers could simply input a target IP address, choose the type and length of attack and submit payment. The service would then direct overwhelming traffic to the specified site, rendering it unusable.
The arrests in Poland were part of a coordinated international crackdown involving authorities from four countries.
Europol provided analytical and operational support throughout the effort.
In a related move, US law enforcement seized nine domain names tied to similar booter services during the same week, adding to its broader campaign against commercial DDoS platforms.
Meanwhile, Dutch authorities launched fake booter sites aimed at deterring would-be users by warning them of possible legal consequences.
Data gathered from earlier seizures in the Netherlands played a critical role in the Polish arrests.
Germany also contributed by identifying one of the suspects and supplying key intelligence on others involved.
DDoS-for-Hire Platforms
Stresser and booter services claim to offer network testing tools, but are commonly used to inflict intentional damage. These services let customers pay for short bursts of high-volume traffic that can knock websites offline.
Unlike botnets, which rely on vast numbers of infected devices, booter services use centralized infrastructure that can be rented and scaled on demand.
These tools are typically promoted on dark web forums and come with built-in anonymity features for both buyers and operators.
This takedown is part of Operation PowerOFF – a wider effort by global law enforcement to dismantle the infrastructure enabling DDoS-for-hire operations.
Read more on Operation PowerOFF: Operation PowerOFF Takes Down DDoS Boosters
