A 22-year-old man from Oregon, identified as Ethan J. Foltz, was arrested on August 6, 2025, for allegedly operating "Rapper Bot," a vast IoT-based botnet used to launch DDoS attacks, including one in March 2025 that disrupted Twitter/X. The botnet comprised tens of thousands of compromised devices and was rented out to facilitate online extortion schemes. Authorities say its attacks often surpassed 2 terabits per second, with some peaks even exceeding 6 terabits, overwhelming all but the most robust targets.

Investigators traced Foltz to the botnet using payment data and internet activity, leading to a search warrant and his subsequent confession. Telegram chat logs revealed that he and an associate, referred to as “Slaykings,” intentionally kept the botnet modest in size to avoid detection—what they called the “Goldilocks” strategy. Despite weekly log wipeouts, records show that from April to early August, Rapper Bot was responsible for over 370,000 DDoS attacks targeting approximately 18,000 victims across 1,000 networks globally. If convicted, Foltz faces up to 10 years in prison for aiding and abetting computer intrusions.

‍

Source: https://krebsonsecurity.com/2025/08/oregon-man-charged-in-rapper-bot-ddos-service/