Oregonian Charged with Monetizing DDoS Attacks Through Rapper Bot

Ethan Foltz, 22, of Eugene, Oregon, has been charged with operating and monetizing the powerful Rapper Bot botnet, which launched more than 370,000 DDoS attacks in 80 countries.

Rapper Bot, also known as the Eleven Eleven Botnet and CowBot, infected between 65,000 and 95,000 Wi-Fi routers and DVRs, using them to launch attacks with a throughput of 2 to 3 terabits per second, with the largest reaching 6 terabits per second. Such attacks cost companies hundreds of thousands of dollars in damages and were often accompanied by ransom demands. According to court documents, Foltz and his accomplices sold access to the botnet to clients who could use it to take down competitors’ services or extort money from victims.

Rapper Bot has been operating since at least 2021 and was considered one of the most powerful DDoS tools available on the black market. In August 2025, the FBI and DCIS cyber agents raided Foltz’s home, took control of the botnet’s infrastructure, and effectively shut it down. This was part of Operation PowerOFF, a global operation aimed at eliminating DDoS-for-hire services.

Foltz was charged with facilitating unauthorized access to computer systems and faces up to 10 years in prison. The case is being seen as a model for combating cybercriminal infrastructures that cause massive damage to businesses and critical services around the world.