FBI, DOJ, and RCMP Seize NightmareStresser DDoS-for-Hire Domains in Latest Operation PowerOFF Action

Key facts for NightmareStresser Operation PowerOFF seizure

Detection coverage for NightmareStresser Operation PowerOFF seizure

As of 2026-09-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2549 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Volumetric L4/L7 DDoS Flood at Network Perimeter (Splunk)

Detects a sharp spike in inbound traffic volume, packet rate, distinct source-IP count, or request rate against a protected asset consistent with the Layer 4 volumetric (direct flood or UDP reflection/amplification via DNS, NTP, SSDP, or Memcached) and Layer 7 application-layer flooding NightmareStresser advertised at up to 200 Gbps, delivered from its botnet of compromised routers/IoT devices via 52 dedicated attack servers.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1498.001, T1498.002, T1499.003, T1583.005
• Data sources: netflow, firewall, web_access_logs
• Severity: critical
• Confidence: high

Splunk SPL

index=network sourcetype IN ("netflow","cisco:asa","pan:traffic") dest_ip=<protected_asset_subnet>
| bucket _time span=1m
| stats sum(bytes) AS total_bytes, sum(packets) AS total_packets, dc(src_ip) AS distinct_sources, values(src_port) AS src_ports by dest_ip, dest_port, protocol, _time
| eval mbps=round((total_bytes*8)/1000000,2)
| eval pps=round(total_packets/60,0)
| eval is_reflection_port=if(mvfind(src_ports,"^(53|123|1900|11211|19|17)$")>=0,1,0)
| where mbps>=500 OR pps>=100000 OR distinct_sources>=500
| eval likely_technique=case(is_reflection_port=1,"T1498.002 - Reflection Amplification",distinct_sources>=500,"T1498.001 - Direct Network Flood",1=1,"Volumetric anomaly - review")
| table _time, dest_ip, dest_port, protocol, mbps, pps, distinct_sources, likely_technique
| append
    [ search index=web sourcetype IN ("access_combined","iis")
      | bucket _time span=1m
      | stats count AS requests, dc(src_ip) AS distinct_sources by dest_ip, uri_path, _time
      | where requests>=5000 OR distinct_sources>=1000
      | eval likely_technique="T1499.003 - Application Exhaustion Flood"
      | table _time, dest_ip, uri_path, requests, distinct_sources, likely_technique ]
| sort - _time

Microsoft KQL

let L4Flood = 
CommonSecurityLog
| where TimeGenerated > ago(1h)
| summarize TotalBytes = sum(SentBytes + ReceivedBytes), DistinctSources = dcount(SourceIP), SourcePorts = make_set(SourcePort) by DestinationIP, DestinationPort, Protocol, bin(TimeGenerated, 1m)
| extend Mbps = round((TotalBytes * 8.0) / 1000000, 2)
| where Mbps >= 500 or DistinctSources >= 500
| extend LikelyTechnique = iff(Protocol == "UDP" and DestinationPort in (53,123,1900,11211,19,17), "T1498.002 - Reflection Amplification", "T1498.001 - Direct Network Flood");
let L7Flood =
AppServiceHTTPLogs
| where TimeGenerated > ago(1h)
| summarize Requests = count(), DistinctSources = dcount(CIp) by CsHost, bin(TimeGenerated, 1m)
| where Requests >= 5000 or DistinctSources >= 1000
| extend LikelyTechnique = "T1499.003 - Application Exhaustion Flood";
L4Flood
| project TimeGenerated, DestinationIP, DestinationPort=tostring(DestinationPort), Protocol, Mbps, DistinctSources, LikelyTechnique
| union (L7Flood | project TimeGenerated, DestinationIP=CsHost, DestinationPort="443", Protocol="HTTP(S)", Mbps=real(0), DistinctSources, LikelyTechnique)
| sort by TimeGenerated desc

Sigma

title: Volumetric DDoS Flood at Network Perimeter (Direct Flood / Reflection Amplification)
id: 9c4f2b6a-1e8d-4c7f-b3a2-6d5e9f1c7a44
status: experimental
description: Detects a sharp spike in inbound traffic volume, packet rate, or distinct source count to a protected asset consistent with a Layer 4 volumetric DDoS flood (direct flood or UDP reflection/amplification via DNS, NTP, SSDP, or Memcached) as delivered by DDoS-for-hire ("booter"/"stresser") platforms such as NightmareStresser.
references:
    - https://www.helpnetsecurity.com/2026/09/17/fbi-nightmarestresser-ddos-for-hire-service-seized/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-17
tags:
    - attack.impact
    - attack.t1498.001
    - attack.t1498.002
    - attack.t1499.003
    - attack.tool.nightmarestresser
logsource:
    category: firewall
    product: generic
detection:
    selection_reflection:
        src_port:
            - 53
            - 123
            - 1900
            - 11211
            - 19
            - 17
        protocol: udp
    selection_volume:
        dst_ip: '<protected_asset_ip_or_cidr>'
    timeframe: 1m
    condition: selection_volume | count() by dst_ip, dst_port > 100000 or (selection_reflection and selection_volume)
falsepositives:
    - Legitimate traffic surge from a flash sale, viral content, or scheduled/authorized load test
    - Misconfigured internal NTP/DNS/Memcached services generating abnormally high legitimate query volume that trips the reflection-port heuristic
level: critical

Known false positives:

• Legitimate traffic surge from a flash sale, viral content, or scheduled/authorized load test
• Misconfigured internal NTP/DNS/Memcached services generating abnormally high legitimate query volume that trips the reflection-port heuristic

Tuning notes: Baseline mbps/pps/distinct_sources and requests thresholds per protected asset from at least 30 days of normal traffic before enabling in blocking/alert-storm mode; validate the reflection-port list (53/123/1900/11211/19/17) against services your own network legitimately exposes to avoid suppressing true reflection traffic on those same ports; route L4 and L7 hits into your existing DDoS-scrubbing/CDN activation runbook.

• 🔒 Router/IoT Management Brute-Force → Botnet Recruitment (Sentinel) · unlock with TL Creds
• 🔒 Beaconing/Connections to Known Booter/Stresser C2 Infrastructure (Sentinel) · unlock with TL Creds
• 🔒 Volumetric L4/L7 DDoS Flood at Network Perimeter (Sentinel) · unlock with TL Creds
• 🔒 Router/IoT Management Brute-Force → Botnet Recruitment (Sigma) · unlock with TL Creds
• 🔒 Beaconing/Connections to Known Booter/Stresser C2 Infrastructure (Sigma) · unlock with TL Creds
• 🔒 Volumetric L4/L7 DDoS Flood at Network Perimeter (Sigma) · unlock with TL Creds
• 🔒 Router/IoT Management Brute-Force → Botnet Recruitment (Splunk) · unlock with TL Creds
• 🔒 Beaconing/Connections to Known Booter/Stresser C2 Infrastructure (Splunk) · unlock with TL Creds

Indicators of compromise for NightmareStresser Operation PowerOFF seizure

As of 2026-09-17, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-2549.

Sample indicators (3 of 16)

• Domain: royalstresser[.]com
• Domain: securityteam[.]io
• Domain: astrostress[.]com

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How NightmareStresser Operation PowerOFF seizure works

NightmareStresser operated since at least 2022, claimed over 566,000 registered users and an affiliate program, ran attacks from 52 dedicated servers against a botnet of compromised routers and IoT devices, and was linked to hundreds of thousands of DDoS attacks or attempted attacks against education, government, gaming, and individual victims worldwide.

NightmareStresser was a subscription-based DDoS-for-hire ('booter'/'stresser') service that marketed itself as the 'longest-running, most powerful' platform of its kind. Operating since at least 2022, it allowed paying customers -- with no technical skill required -- to rent access to a botnet built from compromised home routers and IoT devices and direct it against a target of their choosing. Reporting on the seizure put the platform's attack capacity at up to 200 Gbps, delivered via both Layer 4 (TCP/UDP volumetric) and Layer 7 (application-layer) flooding, run from roughly 52 dedicated servers. NightmareStresser claimed over 566,000 registered users, offered an affiliate/referral program to reward recruiters, and sold attack packages at prices reportedly ranging from about EUR25 to nearly EUR20,000. Victims named by the Department of Justice include educational institutions, government agencies, gaming platforms, and millions of individuals in the United States and abroad. The platform's nightmarestresser.com domain had itself been a target of an earlier December 2022 Operation PowerOFF seizure action, indicating the operators re-established the service on the same or related domains before this second, more complete takedown. NightmareStresser marketed itself with unusual openness about supporting illegal use, describing its own customer base in terms of 'script kiddies' launching attacks for pranks or political agendas, and maintained a public Trustpilot storefront listing with a 3.9-out-of-5 rating and customer reviews ('I have been using the service for over a year. Everything is great.'). Its own marketing claimed operation 'under the laws of Russia' -- an unverified jurisdictional claim by the operators themselves, not a confirmed law-enforcement attribution, consistent with the LOW attribution confidence and unidentified-operator status of this threat record.

The September 15, 2026 seizure of nightmarestresser.com and nightmarestresser.org was carried out jointly by the FBI's Anchorage field office, the U.S. Attorney's Office for the District of Alaska (Assistant U.S. Attorneys Adam Alexander and Ainsley McNerney), and the Royal Canadian Mounted Police's Federal Policing Northwest Region, under the Computer Fraud and Abuse Act. It is the latest action in Operation PowerOFF, a multi-national law-enforcement initiative launched in December 2018 (FBI, Dutch National Police Corps) that has since expanded to include Europol, the UK National Crime Agency, Germany's Federal Criminal Police Office (BKA), Polish Cybercrime Police, and other partners across roughly 15-21 countries, with private-sector investigative support over the operation's history from providers including Cloudflare, PayPal, and DigitalOcean. Over its eight-year run, Operation PowerOFF has charged twelve defendants and seized more than 100 domains tied to booter/stresser services, including a December 2022 action that took down 48 domains (RoyalStresser.com, SecurityTeam.io, Astrostress.com, Booter.sx, Ipstressor.com, TrueSecurityServices.io, and the Quantum booter, the last linked to roughly 50,000 attacks), charged six U.S. defendants, and produced arrests spread across Florida (three), Texas, Hawaii, and New York; a December 2024 action that seized 27 domains across 15 countries, arrested three administrators (including Ricardo Cesar Colli, aka 'TotemanGames,' 22, of Brazil, who operated Securityhide.net) and identified roughly 300 customers; and an April 2026 action that seized eight domains, including Vac Stresser and Mythical Stress, across 20 countries, with Europol reporting four arrests and 25 search warrants and the operation cumulatively identifying roughly 75,000 booter-service users by that point. No individual operators of NightmareStresser itself had been publicly named or charged as of the September 2026 announcement.

MITRE ATT&CK techniques by tactic:

Command and Control

T1071 Application Layer Protocol

Credential Access

T1110.001 Password Guessing

Impact

T1498.001 Direct Network Flood; T1498.002 Reflection Amplification; T1499.003 Application Exhaustion Flood

Resource Development

T1583.001 Domains; T1583.004 Server; T1583.005 Botnet; T1583.006 Web Services; T1584.005 Botnet; T1584.008 Network Devices

Remediation for NightmareStresser Operation PowerOFF seizure

Patches

• No CVE applies; apply vendor firmware updates on routers/IoT devices to close default-credential and remote-management weaknesses exploited to build DDoS botnets

Immediate actions

• Report ongoing DDoS activity to the FBI Internet Crime Complaint Center (IC3) and, for U.S. victims, the local FBI field office
• Engage upstream ISP or DDoS-scrubbing/CDN providers to filter volumetric Layer 4 and Layer 7 flood traffic during an active attack
• Rate-limit and geo/ASN-filter traffic from known booter attack infrastructure and reflection/amplification sources

Workarounds

• Maintain incident-response runbooks and pre-negotiated DDoS mitigation contracts so scrubbing can be activated quickly when a booter-driven flood is detected

Longer-term hardening

• Deploy always-on DDoS mitigation (cloud scrubbing, anycast, CDN) for internet-facing services in education, government, and gaming sectors historically targeted by booter services
• Harden consumer and SMB routers/IoT devices against botnet recruitment: change default credentials, disable unnecessary remote-management interfaces, and keep firmware current
• Participate in ISP-level BCP38/ingress filtering to reduce spoofed-source amplification traffic that booter platforms rely on

Affected and fixed versions

• N/A — NightmareStresser DDoS-for-hire ('booter'/'stresser') platform
  Vulnerable versions: Active 2022 - September 15, 2026 (nightmarestresser.com, nightmarestresser.org)
  Fixed in: Domains seized and service dismantled by FBI/DOJ/RCMP on 2026-09-15
• Various — Consumer routers and IoT devices recruited into DDoS botnets
  Vulnerable versions: Devices with default/weak credentials or exposed remote-management interfaces
  Fixed in: Not applicable; mitigated by credential hardening and firmware updates, not a vendor patch

Timeline of NightmareStresser Operation PowerOFF seizure

• 2018-12-01 FBI and Dutch National Police Corps launch Operation PowerOFF, seizing 15 DDoS-for-hire websites in the initiative's first coordinated action.
• 2022-01-01 locked-ioc-8 begins operating as a DDoS-for-hire booter/stresser service, marketed as the 'longest-running, most powerful' platform of its kind.
• 2022-12-14 DOJ/FBI Operation PowerOFF action seizes 48 booter domains -- including an earlier locked-ioc-4 seizure, locked-ioc-7, locked-ioc-10, locked-ioc-11, locked-ioc-15, locked-ioc-13, locked-ioc-3, and the locked-ioc-16 booter (~50,000 attacks) -- and charges six U.S. defendants, with arrests spread across Florida (three), Texas, Hawaii, and New York.
• 2024-12-12 Europol-coordinated Operation PowerOFF action across 15 countries seizes 27 booter domains, arrests three administrators including locked-ioc-6 ('TotemanGames') for operating locked-ioc-9, and identifies roughly 300 customers.
• 2026-04-01 DOJ-led action across 20 countries seizes eight additional DDoS-for-hire domains, including locked-ioc-14 and locked-ioc-12; Europol reports four arrests and 25 search warrants, with the operation's cumulative user identification reaching roughly 75,000 booter-service customers by this point.
• 2026-09-15 FBI's Anchorage field office, the U.S. Attorney's Office for the District of Alaska, and the Royal Canadian Mounted Police seize the locked-ioc-4 and locked-ioc-5 domains, dismantling locked-ioc-8.
• 2026-09-16 DOJ and FBI Cyber Division publicly announce the locked-ioc-8 seizure; regional Alaska outlets report the action and quote the U.S. Attorney's Office.
• 2026-09-17 CyberScoop, Help Net Security, Cyber Daily, and other outlets report on the locked-ioc-8 takedown and its place within Operation PowerOFF's eight-year history.

Sources cited for NightmareStresser Operation PowerOFF seizure

• FBI Seizes DDoS-for-Hire Domains as Part of Continuing District of Alaska Crackdown on 'Booter' and 'Stresser' DDoS Services justice.gov · Advisory · 2026-09-15
• US takes down NightmareStresser DDoS-for-hire platform radar.offseq.com · Research · 2026-09-17
• Operation PowerOFF en.wikipedia.org · Research · 2026-09-17
• NightmareStresser and Vac Stresser: DOJ takes down NightmareStresser DDoS platform blog.rankiteo.com · Blog · 2026-09-17
• FBI Seizes NightmareStresser DDoS-for-Hire Domains cyberscoop.com · News · 2026-09-17
• Prolific DDoS-for-hire service NightmareStresser seized by US authorities cyberdaily.au · News · 2026-09-17
• Alaska FBI targets DDoS-for-hire sites in international crackdown juneauempire.com · News · 2026-09-16
• FBI takes down one of the longest-running DDoS-for-hire services Help Net Security · News · 2026-09-17
• International crackdown disrupts DDoS-for-hire operations cyberscoop.com · News · 2024-12-12
• Feds Hit DDoS-for-Hire Services with 48 Domain Seizures infosecurity-magazine.com · News · 2022-12-15

More in threat intel

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector
• Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)
• OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism

Previous and next in threat intel

• Rehub: Russian-Language Ransomware-as-a-Service Marketplace Absorbing RAMP's Displaced Operators Previous report
• France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months Next report