# FBI, DOJ, and RCMP Seize NightmareStresser DDoS-for-Hire Domains in Latest Operation PowerOFF Action

> On September 15, 2026, the FBI's Anchorage field office, the U.S. Attorney's Office for the District of Alaska, and the Royal Canadian Mounted Police seized the nightmarestresser.com and nightmarestresser.org domains, dismantling one of the longest-running DDoS-for-hire ('booter'/'stresser') platforms. NightmareStresser operated since at least 2022, claimed over 566,000 registered users and an affiliate program, ran attacks from 52 dedicated servers against a botnet of compromised routers and IoT devices, and was linked to hundreds of thousands of DDoS attacks or attempted attacks against education, government, gaming, and individual victims worldwide.

- **Published:** 2026-09-17T00:00:00Z
- **Last reviewed:** 2026-09-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2549
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-nightmarestresser-operation-poweroff-seizure-tl-2026-2549.webp?v=531a6beb (Threadlinqs threat intel: NightmareStresser DDoS-for-Hire Takedown: Analysis & Hunting (TL-2026-2549) — Medium severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-2549
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MITIGATED
- **Actor:** NightmareStresser operators
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

NightmareStresser was a subscription-based DDoS-for-hire ('booter'/'stresser') service that marketed itself as the 'longest-running, most powerful' platform of its kind. Operating since at least 2022, it allowed paying customers -- with no technical skill required -- to rent access to a botnet built from compromised home routers and IoT devices and direct it against a target of their choosing. Reporting on the seizure put the platform's attack capacity at up to 200 Gbps, delivered via both Layer 4 (TCP/UDP volumetric) and Layer 7 (application-layer) flooding, run from roughly 52 dedicated servers. NightmareStresser claimed over 566,000 registered users, offered an affiliate/referral program to reward recruiters, and sold attack packages at prices reportedly ranging from about EUR25 to nearly EUR20,000. Victims named by the Department of Justice include educational institutions, government agencies, gaming platforms, and millions of individuals in the United States and abroad. The platform's nightmarestresser.com domain had itself been a target of an earlier December 2022 Operation PowerOFF seizure action, indicating the operators re-established the service on the same or related domains before this second, more complete takedown. NightmareStresser marketed itself with unusual openness about supporting illegal use, describing its own customer base in terms of 'script kiddies' launching attacks for pranks or political agendas, and maintained a public Trustpilot storefront listing with a 3.9-out-of-5 rating and customer reviews ('I have been using the service for over a year. Everything is great.'). Its own marketing claimed operation 'under the laws of Russia' -- an unverified jurisdictional claim by the operators themselves, not a confirmed law-enforcement attribution, consistent with the LOW attribution confidence and unidentified-operator status of this threat record.

The September 15, 2026 seizure of nightmarestresser.com and nightmarestresser.org was carried out jointly by the FBI's Anchorage field office, the U.S. Attorney's Office for the District of Alaska (Assistant U.S. Attorneys Adam Alexander and Ainsley McNerney), and the Royal Canadian Mounted Police's Federal Policing Northwest Region, under the Computer Fraud and Abuse Act. It is the latest action in Operation PowerOFF, a multi-national law-enforcement initiative launched in December 2018 (FBI, Dutch National Police Corps) that has since expanded to include Europol, the UK National Crime Agency, Germany's Federal Criminal Police Office (BKA), Polish Cybercrime Police, and other partners across roughly 15-21 countries, with private-sector investigative support over the operation's history from providers including Cloudflare, PayPal, and DigitalOcean. Over its eight-year run, Operation PowerOFF has charged twelve defendants and seized more than 100 domains tied to booter/stresser services, including a December 2022 action that took down 48 domains (RoyalStresser.com, SecurityTeam.io, Astrostress.com, Booter.sx, Ipstressor.com, TrueSecurityServices.io, and the Quantum booter, the last linked to roughly 50,000 attacks), charged six U.S. defendants, and produced arrests spread across Florida (three), Texas, Hawaii, and New York; a December 2024 action that seized 27 domains across 15 countries, arrested three administrators (including Ricardo Cesar Colli, aka 'TotemanGames,' 22, of Brazil, who operated Securityhide.net) and identified roughly 300 customers; and an April 2026 action that seized eight domains, including Vac Stresser and Mythical Stress, across 20 countries, with Europol reporting four arrests and 25 search warrants and the operation cumulatively identifying roughly 75,000 booter-service users by that point. No individual operators of NightmareStresser itself had been publicly named or charged as of the September 2026 announcement.

## MITRE ATT&CK

- T1498.001 Direct Network Flood
- T1499.003 Application Exhaustion Flood
- T1583.001 Domains
- T1583.005 Botnet
- T1584.005 Botnet
- T1584.008 Network Devices
- T1583.004 Server
- T1583.006 Web Services
- T1071 Application Layer Protocol
- T1498.002 Reflection Amplification
- T1110.001 Password Guessing

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Volumetric L4/L7 DDoS Flood at Network Perimeter (Splunk)** (`TL-2026-2549-SPL-003`)

Detects a sharp spike in inbound traffic volume, packet rate, distinct source-IP count, or request rate against a protected asset consistent with the Layer 4 volumetric (direct flood or UDP reflection/amplification via DNS, NTP, SSDP, or Memcached) and Layer 7 application-layer flooding NightmareStresser advertised at up to 200 Gbps, delivered from its botnet of compromised routers/IoT devices via 52 dedicated attack servers.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1498.001, T1498.002, T1499.003, T1583.005
- **Data sources:** netflow, firewall, web_access_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype IN ("netflow","cisco:asa","pan:traffic") dest_ip=<protected_asset_subnet>
| bucket _time span=1m
| stats sum(bytes) AS total_bytes, sum(packets) AS total_packets, dc(src_ip) AS distinct_sources, values(src_port) AS src_ports by dest_ip, dest_port, protocol, _time
| eval mbps=round((total_bytes*8)/1000000,2)
| eval pps=round(total_packets/60,0)
| eval is_reflection_port=if(mvfind(src_ports,"^(53|123|1900|11211|19|17)$")>=0,1,0)
| where mbps>=500 OR pps>=100000 OR distinct_sources>=500
| eval likely_technique=case(is_reflection_port=1,"T1498.002 - Reflection Amplification",distinct_sources>=500,"T1498.001 - Direct Network Flood",1=1,"Volumetric anomaly - review")
| table _time, dest_ip, dest_port, protocol, mbps, pps, distinct_sources, likely_technique
| append
    [ search index=web sourcetype IN ("access_combined","iis")
      | bucket _time span=1m
      | stats count AS requests, dc(src_ip) AS distinct_sources by dest_ip, uri_path, _time
      | where requests>=5000 OR distinct_sources>=1000
      | eval likely_technique="T1499.003 - Application Exhaustion Flood"
      | table _time, dest_ip, uri_path, requests, distinct_sources, likely_technique ]
| sort - _time
```

### Microsoft KQL

```kql
let L4Flood = 
CommonSecurityLog
| where TimeGenerated > ago(1h)
| summarize TotalBytes = sum(SentBytes + ReceivedBytes), DistinctSources = dcount(SourceIP), SourcePorts = make_set(SourcePort) by DestinationIP, DestinationPort, Protocol, bin(TimeGenerated, 1m)
| extend Mbps = round((TotalBytes * 8.0) / 1000000, 2)
| where Mbps >= 500 or DistinctSources >= 500
| extend LikelyTechnique = iff(Protocol == "UDP" and DestinationPort in (53,123,1900,11211,19,17), "T1498.002 - Reflection Amplification", "T1498.001 - Direct Network Flood");
let L7Flood =
AppServiceHTTPLogs
| where TimeGenerated > ago(1h)
| summarize Requests = count(), DistinctSources = dcount(CIp) by CsHost, bin(TimeGenerated, 1m)
| where Requests >= 5000 or DistinctSources >= 1000
| extend LikelyTechnique = "T1499.003 - Application Exhaustion Flood";
L4Flood
| project TimeGenerated, DestinationIP, DestinationPort=tostring(DestinationPort), Protocol, Mbps, DistinctSources, LikelyTechnique
| union (L7Flood | project TimeGenerated, DestinationIP=CsHost, DestinationPort="443", Protocol="HTTP(S)", Mbps=real(0), DistinctSources, LikelyTechnique)
| sort by TimeGenerated desc
```

### Sigma

```yaml
title: Volumetric DDoS Flood at Network Perimeter (Direct Flood / Reflection Amplification)
id: 9c4f2b6a-1e8d-4c7f-b3a2-6d5e9f1c7a44
status: experimental
description: Detects a sharp spike in inbound traffic volume, packet rate, or distinct source count to a protected asset consistent with a Layer 4 volumetric DDoS flood (direct flood or UDP reflection/amplification via DNS, NTP, SSDP, or Memcached) as delivered by DDoS-for-hire ("booter"/"stresser") platforms such as NightmareStresser.
references:
    - https://www.helpnetsecurity.com/2026/09/17/fbi-nightmarestresser-ddos-for-hire-service-seized/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-17
tags:
    - attack.impact
    - attack.t1498.001
    - attack.t1498.002
    - attack.t1499.003
    - attack.tool.nightmarestresser
logsource:
    category: firewall
    product: generic
detection:
    selection_reflection:
        src_port:
            - 53
            - 123
            - 1900
            - 11211
            - 19
            - 17
        protocol: udp
    selection_volume:
        dst_ip: '<protected_asset_ip_or_cidr>'
    timeframe: 1m
    condition: selection_volume | count() by dst_ip, dst_port > 100000 or (selection_reflection and selection_volume)
falsepositives:
    - Legitimate traffic surge from a flash sale, viral content, or scheduled/authorized load test
    - Misconfigured internal NTP/DNS/Memcached services generating abnormally high legitimate query volume that trips the reflection-port heuristic
level: critical
```

**Known false positives:**

- Legitimate traffic surge from a flash sale, viral content, or scheduled/authorized load test
- Misconfigured internal NTP/DNS/Memcached services generating abnormally high legitimate query volume that trips the reflection-port heuristic

**Tuning notes:** Baseline mbps/pps/distinct_sources and requests thresholds per protected asset from at least 30 days of normal traffic before enabling in blocking/alert-storm mode; validate the reflection-port list (53/123/1900/11211/19/17) against services your own network legitimately exposes to avoid suppressing true reflection traffic on those same ports; route L4 and L7 hits into your existing DDoS-scrubbing/CDN activation runbook.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Router/IoT Management Brute-Force → Botnet Recruitment (Sentinel) (locked: unlock with TL Creds)
- Beaconing/Connections to Known Booter/Stresser C2 Infrastructure (Sentinel) (locked: unlock with TL Creds)
- Volumetric L4/L7 DDoS Flood at Network Perimeter (Sentinel) (locked: unlock with TL Creds)
- Router/IoT Management Brute-Force → Botnet Recruitment (Sigma) (locked: unlock with TL Creds)
- Beaconing/Connections to Known Booter/Stresser C2 Infrastructure (Sigma) (locked: unlock with TL Creds)
- Volumetric L4/L7 DDoS Flood at Network Perimeter (Sigma) (locked: unlock with TL Creds)
- Router/IoT Management Brute-Force → Botnet Recruitment (Splunk) (locked: unlock with TL Creds)
- Beaconing/Connections to Known Booter/Stresser C2 Infrastructure (Splunk) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- Domain: `royalstresser[.]com`
- Domain: `securityteam[.]io`
- Domain: `astrostress[.]com`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [FBI Seizes NightmareStresser DDoS-for-Hire Domains](https://cyberscoop.com/fbi-seizes-nightmarestresser-ddos-for-hire-domains/)
- [FBI Seizes DDoS-for-Hire Domains as Part of Continuing District of Alaska Crackdown on 'Booter' and 'Stresser' DDoS Services](https://www.justice.gov/usao-ak/pr/fbi-seizes-ddos-hire-domains-part-continuing-district-alaska-crackdown-booter-and)
- [Prolific DDoS-for-hire service NightmareStresser seized by US authorities](https://www.cyberdaily.au/security/14196-prolific-ddos-for-hire-service-nightmarestresser-seized-by-us-authorities)
- [Alaska FBI targets DDoS-for-hire sites in international crackdown](https://www.juneauempire.com/2026/09/16/alaska-fbi-targets-ddos-for-hire-sites-in-international-crackdown/)
- [FBI takes down one of the longest-running DDoS-for-hire services](https://www.helpnetsecurity.com/2026/09/17/fbi-nightmarestresser-ddos-for-hire-service-seized/)
- [US takes down NightmareStresser DDoS-for-hire platform](https://radar.offseq.com/threat/us-takes-down-nightmarestresser-ddos-for-hire-platform-fea7f8e55dc17ada)
- [Operation PowerOFF](https://en.wikipedia.org/wiki/Operation_PowerOFF)
- [International crackdown disrupts DDoS-for-hire operations](https://cyberscoop.com/international-crackdown-disrupts-ddos-for-hire-operations/)
- [Feds Hit DDoS-for-Hire Services with 48 Domain Seizures](https://www.infosecurity-magazine.com/news/feds-hit-ddosforhire-48-domain/)
- [NightmareStresser and Vac Stresser: DOJ takes down NightmareStresser DDoS platform](https://blog.rankiteo.com/fbivbi1789597661-nightmarestresser-vac-stresser-cyber-attack-september-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2549