Four arrested in Poland over global DDoS-for-Hire network takedown

Polish authorities have arrested four individuals suspected of operating a network of DDoS-for-hire platforms that facilitated thousands of cyberattacks against a wide range of global targets, including schools, government agencies, private businesses, and online gaming services. The arrests mark a major development in the ongoing international crackdown on commercial distributed denial-of-service (DDoS) operations.

The suspects are allegedly linked to six separate stresser and booter services — Cfxapi, Cfxsecurity, neostress, jetstress, quickdown, and zapcut — which have now been taken offline as part of a coordinated law enforcement effort involving authorities from Poland, Germany, the Netherlands, and the United States. Europol confirmed the action on Wednesday, calling it the latest blow to the illicit market for DDoS-for-hire services.

These platforms, often promoted on dark web forums and advertised as tools for testing network resilience, are in reality widely used to disrupt legitimate online services. DDoS attacks work by overwhelming a server or website with massive amounts of traffic, rendering them inaccessible to regular users. According to Europol, customers could purchase attacks for as little as 10 euros, using user-friendly interfaces that required no technical knowledge beyond submitting the target’s IP address and selecting an attack method and duration.

Intelligence gathered by Dutch law enforcement from the seized platforms was instrumental in the arrests. The Netherlands shared this data with international partners, leading to the identification and apprehension of four administrators in Poland. U.S. authorities also seized nine domains as part of the broader enforcement campaign, while German investigators contributed by identifying a key suspect and providing intelligence on additional individuals involved.

In a parallel strategy to combat the spread of such services, Dutch authorities have created decoy booter websites to warn potential users that purchasing or launching DDoS attacks is illegal and closely monitored.

This latest operation is part of Operation PowerOFF, a multi-year global initiative launched in December 2018 to dismantle DDoS-for-hire infrastructures. Since its inception, the operation has resulted in numerous seizures and arrests, including the takedown of the Dstat.cc review platform, the UK-based DigitalStress service, and the capture of two additional operators in Poland. Other enforcement phases have led to the removal of 61 domains offering similar services.