Young Oregonian Allegedly Behind Global Cyberattack Botnet That Hit 80 Countries

A 22-year-old Oregon man is reportedly the mastermind behind the “Rapper Bot” DDoS-for-hire botnet, which has launched large-scale Cyber attacks in over 80 countries in the last few years.

The criminal complaint reveals that the Rapper Bot allegedly launched more than 370,000 attacks, which targeted 18,000 unique victims from April 2025 to the present. The attacks included a U.S. Government network, several U.S. tech companies, and a popular social media platform.

Ethan Foltz of Eugene is accused of being the administrator of Rapper Bot, which has been involved in Cyber attacks since at least 2021, according to court documents revealed in Anchorage, Alaska.

Rapper Bot Infects WiFi Routers and Digital Video Recorders

Also known as “Eleven Eleven Botnet” and “CowBot,” the Rapper Bot infects devices like WiFi routers and Digital Video Recorders with specialized malware. Rapper Bot clients then send commands to infected devices, which relay large volumes of “Distributed Denial of Service” (DDoS) traffic to victim computers and servers globally.

Court documents state that Foltz and his co-conspirators, described as a transnational criminal group, allegedly monetized Rapper Bot and provided select paying customers access to the most highly sophisticated and powerful DDoS-for-hire Botnets in existence.

The criminal complaint explains that Rapper Bot has allegedly utilized between 65,000 to 95,000 infected victim devices to regularly launch DDoS attacks measuring between two to three Terabits per second. It is further alleged that the largest attack by Rapper Bot may have exceeded six terabits per second.

Investigators believe that at least five infected victim devices are in Alaska and were forced to participate in attacks.

Two Terabits Per Second Cyber Attacks Can Cost Upwards of $10,000

The criminal complaint alleges that some Rapper Bot customers extorted victims by leveraging the scale of DDoS attacks. It also states that an attack averaging more than two terabits per second and lasting 30 seconds could cost a victim between $500 and $10,000.

Agents from the Defense Criminal Investigative Service Took Control of the Rapper Bot During a Search of the Suspect’s Home in Eugene

Foltz’s residence in Eugene was searched by law enforcement officers on August 6, 2025, who terminated Rapper Bot’s attack capabilities and obtained administrative control of the bot.

There have been no reports of further Rapper Bot Cyber attacks since the transfer of Botnet control to the Defense Criminal Investigative Service (DCIS).

Foltz is charged with one count of aiding and abetting computer intrusions and, if convicted, faces a maximum penalty of 10 years in prison.

The DCIS is investigating the case, assisted by the U.S. Attorney’s Office for the District of Oregon. Assistant U.S. Attorney Adam Alexander is prosecuting the case.