FBI Seizes NightmareStresser, One of the Longest-Running DDoS-for-Hire Platforms
The US Federal Bureau of Investigation seized the domains behind NightmareStresser, a distributed denial-of-service (DDoS) “booter” service that had marketed itself as the internet’s top on-demand attack tool. The FBI’s Cyber Division said the platform had been used since 2022 to launch or attempt hundreds of thousands of DDoS attacks against targets around the world, and the seizure was carried out under Operation PowerOFF, a continuing multinational law enforcement effort against DDoS-for-hire infrastructure that dates back to 2018.
Booter or “stresser” services like NightmareStresser rent access to botnets built from compromised routers and IoT devices, letting paying customers flood a target’s network or website with traffic without needing any technical skill of their own. Research from cybersecurity firm Searchlight Cyber found that NightmareStresser had accumulated more than 566,000 registered users and operated 52 dedicated servers capable of launching attacks as large as 200 Gbps against both network-layer and application-layer targets. This is not the platform’s first brush with law enforcement: the same domain was previously seized in December 2022 alongside the arrest of six people accused of running multiple similar services, though the operation evidently resumed under new domains afterward.
The takedown is the latest in a series of Operation PowerOFF actions, which have previously dismantled the DigitalStress service in the United Kingdom, the Dstat.cc DDoS review site in Germany, and dozens of other booter domains across separate enforcement waves in the US and Poland. Officials frame the recurring campaign as an effort to raise the operational cost of running DDoS-for-hire businesses, even though, as NightmareStresser’s history shows, seized operators or their infrastructure sometimes resurface. The service’s customer base reportedly included attacks against schools, government agencies, and gaming platforms, reflecting how accessible and cheap DDoS-for-hire tools have made it for low-skilled actors to disrupt everyday online services.