INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Operation PowerOFF identifies 75k DDoS users, takes down domains

| 2026-04-16 22:26 LOW LOW DDOS & DISRUPTION
JSON
Executive Summary
AI-generated
A global cyber operation, Operation PowerOFF, was launched in April 2026, involving authorities from 21 countries including the European Union and several other nations. The operation targeted individuals using distributed denial-of-service (DDoS) platforms for disruptive attacks, with more than 75,000 users being warned through emails and letters. Authorities seized 53 domains and arrested four people allegedly involved in these operations, which were supported by Europol. The attack works by allowing users to pay for renting the firepower of DDoS swarms, typically consisting of compromised routers and IoTs, and directing it to their intended targets. As of now, the operation has entered its prevention phase, with measures including launching awareness campaigns and disruption measures such as removing URLs that promote illegal services from search results.
Technical Mitigations AI-generated
• Targeting DDoS-for-hire platforms, such as Booter services (e.g. "booter services" mentioned in Source 1), to disrupt their technical infrastructure and dismantle key infrastructure. • Removing from search results more than 100 URLs that promote illegal DDoS services (Source 2). • Blocking or hunting for indicator-based attacks using AI-chained zero-days, such as the exploit described at the Autonomous Validation Summit (Source 1).
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation PowerOFFOperation PowerOFF
Target & Sectors
NORDICS NORDICS BENELUX BENELUX EUROPE EUROPE DACH DACH NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎2026/04/16
Threat actors used DDoS-for-hire tools to target over 75,000 individuals for disruptive attacks.
infrastructure 53 domains
Operation PowerOFF identifies 75k DDoS users, takes down 53 domains.
Officials seize 53 DDoS-for-hire domains in ongoing crackdown.
Authorities from 21 countries took down 53 domains and arrested four people allegedly involved in distributed denial-of-service operations used by more than 75,000 cybercriminals, Europol said Thursday.
Coordinated efforts led to the arrest of four people, taking offline 53 domains, and issuing 25 search warrants.
infrastructure 27 domain takedowns
The international crackdown disrupted other popular DDoS-for-hire services in late 2024, netting three arrests and 27 domain takedowns.
data_breach 3 data
Law enforcement agencies obtained data on more than 3 million alleged criminal user accounts from the seized databases, and ultimately sent more than 75,000 emails and letters to participants, warning them to halt their activities.
Tactical Metrics
Metrics
infrastructure
53
Domains
Officials seize 53 DDoS-for-hire domains in ongoing crackdown.
Authorities from 21 countries took down 53 domains and arrested four people allegedly involved in distributed denial-of-service operations used by more than 75,000 cybercriminals, Europol said Thursday.
Operation PowerOFF identifies 75k DDoS users, takes down 53 domains.
Coordinated efforts led to the arrest of four people, taking offline 53 domains, and issuing 25 search warrants.
Metrics
infrastructure
27
Domain Takedowns
The international crackdown disrupted other popular DDoS-for-hire services in late 2024, netting three arrests and 27 domain takedowns.
Metrics
data_breach
3,000,000
Data
Law enforcement agencies obtained data on more than 3 million alleged criminal user accounts from the seized databases, and ultimately sent more than 75,000 emails and letters to participants, warning them to halt their activities.
Intelligence Sources
CyberScoop 2026-04-16
BleepingComputer 2026-04-16