Emerging ThreatsMalware & Ransomware

Operation PowerOFF Disrupts 53 DDoS Domains, Uncovers 3 Million Criminal Accounts

Analyst 207||Source: TheHackerNews
Dimly lit server room with spotlight on a globe map marked with red X's.

What happens when the marketplaces that sell digital disruption are suddenly shuttered? An international law enforcement push against commercial DDoS services has removed pieces of that market — but the full fallout and the scope of what investigators gained remain only partly revealed.

What happened

International law enforcement authorities carried out an operation, dubbed Operation PowerOFF, that took down 53 domains and resulted in four arrests. The effort targeted commercial distributed denial-of-service (DDoS) operations that, according to the reporting, were used by more than 75,000 cybercriminals. Investigators disrupted access to the DDoS-for-hire services and took down the technical infrastructure supporting them.

Background and immediate effects

The services targeted were commercial DDoS-for-hire operations. By removing domains and dismantling supporting infrastructure, Operation PowerOFF interrupted how those services were accessed. Beyond those actions, the source material says the operation “obtained access to” but does not specify what was accessed or what, if any, data or systems were seized or analyzed.

Why this matters — perspectives to consider

  • Technologists: Disrupting domains and infrastructure can blunt active attack platforms and limit immediate capability for coordinated DDoS campaigns, but technical resilience and rapid reconstitution are common features of such ecosystems.
  • Policymakers and law enforcement: Arrests and infrastructure takedowns are tangible markers of enforcement, yet the incomplete disclosure about what was obtained leaves open questions about intelligence value and follow-on investigative opportunities.
  • Users and targets: Organizations that have been victims of commercial DDoS services may see reduced short-term risk from the specific services taken offline; long-term protection depends on broader changes in attacker behavior and market dynamics.
  • Adversaries and service operators: Actors who profit from or rely on commercial DDoS offerings may attempt to migrate to new domains, alternative platforms, or decentralized tools — a dynamic that enforcement actions can disrupt but not always eliminate.

Open questions and the road ahead

The operation removed 53 domains and led to four arrests and, the report states, “obtained access to” — a phrase left without further detail in the source material. That gap frames the central uncertainty: how much actionable evidence or intelligence did investigators secure, and how will it shape prosecutions, prevention efforts, or follow-on takedowns? The answers will determine whether this is a short-term disruption or the start of a longer decline in the commercial DDoS market.

Operation PowerOFF demonstrates that international cooperation can dismantle visible parts of cybercrime infrastructure. The larger lesson — and the lingering question — is how resilient those illicit markets will be once pressure eases. Will disruption produce durable deterrence, or simply another temporary outage in a business that can too often reboot?

Original story: https://thehackernews.com/2026/04/operation-poweroff-seizes-53-ddos.html

CybercrimeDdosEmerging ThreatsInternational CooperationLaw EnforcementDistributed Denial-of-ServiceOperation Poweroff
Related Intelligence

Continue Reading

Cluttered office desk with open laptop, invoices, and scattered papers showing signs of disruption.

EvilTokens Phishing Kit Exposes Sophisticated Evasion Tactics

Microsoft VP of security research Tanmay Ganacharya revealed that 10-15 distinct EvilTokens phishing campaigns have been launching daily since March 15, 2026, showcasing the alarming speed at which device-code phishing operations have scaled. This comes as Cisco Talos incident responders uncovered a targeted phishing chain that abused a real vendor relationship using an outstanding-invoice lure.

Analyst 207
Rows of rack-mounted servers and equipment in a brightly-lit server room or data center interior.

FortiBleed Campaign Tied to Lynx Ransomware Operators

Researchers uncovered a massive credential-theft operation, dubbed FortiBleed, which exposed over 73,000 Fortinet device credentials and was surprisingly linked to active ransomware negotiation panels. This shocking discovery offers a rare glimpse into the tactics of threat actors.

Analyst 207
Cybersecurity researcher sits at cluttered desk with laptop and papers, looking concerned.

Malware Exploits GitHub PoCs to Target Cybersecurity Researchers

Cybersecurity researchers are being targeted by a sneaky new campaign that uses malicious GitHub proof-of-concept exploits to deliver a remote access trojan, with over 2,400 downloads of a trojanized Python package already recorded. The attack unfolds through a multi-stage supply-chain trick involving compromised PyPI packages.

Analyst 207
Office setting with computer workstation and network server equipment in foreground.

Kubota Discloses Month-Long Network Breach Exposing Sensitive Employee Data

Kubota North America Corporation revealed a concerning network breach that lasted a month, exposing sensitive personal data of employees and their dependents to unauthorized access. The incident, which occurred between March 16 and April 20, has prompted the company to implement enhanced security measures to prevent future breaches.

Analyst 207