A coordinated international law enforcement action supported by Europol has targeted the global DDoS-for-hire ecosystem, identifying more than 75,000 users involved in launching attacks.
The operation, part of the ongoing Operation PowerOFF initiative, brought together authorities from 21 countries during a joint action week on 13 April 2026. According to Europol, enforcement and prevention measures included over 75,000 warning messages sent to identified users, four arrests, 25 search warrants, and the takedown of 53 domains linked to booter services.
Infrastructure disruption and data exploitation
Ahead of the coordinated action, law enforcement agencies conducted a series of operational sprints targeting high-value users and infrastructure behind DDoS-for-hire platforms.
Booter services, commercialised platforms that allow users to launch DDoS attacks against servers, websites, and networks, were the primary focus. Authorities seized backend infrastructure, including servers and databases, effectively disrupting service availability and degrading operational capacity.
Analysis of seized datasets played a key role. Europol reports that data from these systems exposed more than 3 million user accounts associated with DDoS-for-hire services. This intelligence was shared across participating countries, enabling coordinated enforcement actions and user notifications at scale.
Low barrier to entry continues to drive abuse
DDoS-for-hire services remain one of the most accessible entry points into cybercrime. Platforms typically offer simplified interfaces and step-by-step workflows, allowing users with minimal technical expertise to launch attacks.
At the same time, more advanced actors continue to customise attack parameters, optimise traffic generation, and target specific infrastructure. Europol notes that targets are often regionally aligned and include online services, telecommunications providers, and web-based platforms.
Motivations vary widely, ranging from experimentation and curiosity to financial extortion, competitive disruption, and ideologically motivated activity.
PowerOFF working to reduce DDoS-for-hire demand
Operation PowerOFF is now moving further into its prevention phase, combining enforcement with proactive disruption tactics aimed at reducing demand.
Measures highlighted by Europol include:
- Removal of more than 100 URLs advertising DDoS-for-hire services from search engine results
- Targeted advertising campaigns aimed at users searching for booter platforms
- Blockchain-based warning messages directed at users transacting for DDoS services
- Continued updates to public-facing resources tracking enforcement actions
From an operational perspective, Europol provided analytical support, crypto-tracing, and forensic expertise, alongside coordinating intelligence sharing and hosting a central command post during the action phase.
Image credits: adapted from OSeveno, CC BY-SA 3.0 https://creativecommons.org/licenses/by-sa/3.0, via Wikimedia Commons
