22-Year-Old Arrested for Running Massive DDoS Botnet, Rapper Bot
A 22-year-old Oregon man, Ethan J. Foltz, has been arrested for operating Rapper Bot, a powerful botnet used for launching DDoS attacks. Foltz faces up to 10 years in prison if convicted of aiding and abetting computer intrusions.
Rapper Bot, active from April 2025 to early August, conducted over 370,000 attacks, targeting 18,000 unique victims across 1,000 networks. It was responsible for the March 10, 2025 attack that caused intermittent outages on Twitter/X. The botnet is a globally dispersed collection of tens of thousands of hacked IoT devices, capable of launching attacks over two terabits per second.
Foltz admitted to building and operating Rapper Bot, sharing profits 50/50 with a person known only by the hacker handle 'Slaykings'. The botnet's control panel greets users with the message 'Welcome to the Ball Pit, Now with refrigerator support', referencing enslaved IoT refrigerators. Rapper Bot's most lucrative and frequent customers were involved in extorting online businesses, including numerous gambling operations based in China. The botnet consistently launched attacks that were 'hundreds of times larger than the expected capacity of a typical server', with some exceeding six terabits per second.
Foltz's arrest sheds light on the growing threat of DDoS attacks facilitated by botnets like Rapper Bot. If convicted, he could face up to 10 years in prison. The investigation is ongoing, with authorities yet to identify the unknown head of the rap group Bot-Botnetz, suspected to be linked to Foltz.
