Alleged Mastermind Behind Rapper Bot DDoS Botnet Arrested and Charged

US Federal Prosecutors have charged 22-year-old Ethan Foltz from Eugene, Oregon, with operating Rapper Bot, a sophisticated botnet used for large-scale Distributed Denial-of-Service (DDoS) attacks globally. Court documents reveal that Foltz developed and managed the botnet, which was also known as “Eleven Eleven Botnet” and “CowBot”. Investigators assert that Rapper Bot infected various internet-connected devices, including digital video recorders and WiFi routers, utilising a variant of the Mirai malware, a prevalent tool for botnet creation. Since April 2025, the botnet has allegedly been involved in over 370,000 attacks targeting at least 18,000 different entities across more than 80 countries, including a US government network and several American technology firms.

The Rapper Bot reportedly comprised between 65,000 and 95,000 infected devices at any given time, with attack speeds reaching two to three terabits per second, and in some instances, peaking at six terabits per second. Such high-volume attacks can inflict significant financial damage, costing victims between $500 and $10,000 for a 30-second assault, depending on the impact. The criminal complaint indicates that some customers of Rapper Bot engaged in DDoS extortion, demanding payment to cease attacks. On August 6, 2025, federal agents executed a search warrant at Foltz’s residence, seizing control of Rapper Bot and disabling it. Since then, no new attacks have been reported. Foltz faces a federal charge of aiding and abetting computer intrusions, with a potential sentence of up to 10 years in prison. This arrest is part of a broader crackdown on operators of booter and stresser services that facilitate DDoS attacks. 

Categories: Cybercrime, Botnets, DDoS Attacks 

Tags: Rapper Bot, Botnet, DDoS Attacks, Mirai, Infected Devices, Cybercrime, Extortion, Federal Prosecutors, Oregon, Computer Intrusions