NightmareStresser DDoS Service Disrupted in International Operation
The US Department of Justice, in coordination with international law enforcement, has taken down NightmareStresser, a long-standing and widely used DDoS-for-hire service. This disruption is part of a broader effort to combat the proliferation of these services and hold those involved accountable, following years of similar operations and arrests.
The US Department of Justice, alongside international law enforcement, announced the disruption of NightmareStresser, a prominent DDoS-for-hire service operating since at least 2022. The service, accessible through domains like nightmare-stresser[.]com and nightmarestresser[.]org, facilitated the launch of hundreds of thousands of attacks against victims globally. Security researcher Alex Carter indicated that NightmareStresser’s origins date back to 2016, gaining significant popularity in 2018 following the shutdowns of competing services, ultimately becoming the largest DDoS tool by 2019. By 2025, it boasted nearly 1 million users, capable of initiating between 3,000 and 4,000 attacks per hour and accepting cryptocurrency payments. Notably, the service deliberately avoided targeting government, educational, and healthcare domains. The disruption is part of Operation PowerOFF, a global initiative targeting DDoS-for-hire infrastructures and those involved in their operation. Law enforcement has been tracking and charging both administrators and users of these services over the past eight years, resulting in the seizure of over 100 domains and the prosecution of 12 individuals. This latest takedown represents another step in combating the increasing availability of these services to cybercriminals.