Operation PowerOFF, a cross-border law enforcement push aimed at DDoS-for-hire services, has identified more than 75,000 individuals using distributed denial-of-service platforms. The warning is being sent out through emails and letters, which—if you’ve ever gotten one of those formal “we know what you did” messages—feels pretty direct.
The action is supported by Europol and involves authorities in 21 countries. According to the operation’s latest phase, coordinated efforts led to the arrest of four people, taking offline 53 domains, and issuing 25 search warrants. There were also “operational sprints” leading up to the action week, where experts from national authorities gathered to target high-value users and raise awareness about the illegality of these activities.
During those sprints, participating countries disrupted illegal booter services—basically the back-end marketplaces that let people rent DDoS “firepower” for disruptive attacks. Misryoum newsroom reported that the technical infrastructure underpinning those booter services was dismantled. It’s one thing to read about DDoS at a high level; it’s another to see that the effort is going after the plumbing, not just the headlines.
“Booter services” are DDoS-for-hire platforms that allow users to pay for renting the firepower of DDoS swarms, typically consisting of compromised routers and IoTs, and directing it to their intended targets. Some operators try to mask the intent by claiming their tools are for legitimate stress testing. But they often don’t verify target ownership, which means the services are still used for illegal attacks. And yes, that “stress testing” argument comes up a lot—like it should be a magic shield. Usually it isn’t.
The operation’s reach is global. It includes multiple European Union countries as well as Australia, Thailand, the United States, the United Kingdom, Japan, and Brazil. The latest phase builds on earlier work that reportedly dismantled key infrastructure and seized databases with more than 3 million criminal accounts. So, this isn’t a one-off incident response; it’s a multi-phase crackdown that keeps stacking evidence and disruptions.
Misryoum editorial desk noted that Operation PowerOFF is now moving into a prevention phase. That includes launching awareness campaigns and disruption measures—some of which are pretty targeted in how they go after demand. The plan involves placing search engine ads aimed at young people seeking DDoS tools, removing from search results more than 100 URLs that promote these illegal services, and adding on-chain warning messages tied to illicit payments. That on-chain piece is interesting, because it suggests the disruption isn’t confined to the usual web layer; it follows the money trail, or at least tries to warn it as it moves.
Do We Really Need Another Development Board?
Agents don’t know what good looks like—so guardrails matter
Salesforce turns itself into an AI-agent platform with Headless 360