Oregon Man, 22, Accused of Massive 'Rapper Bot' Cyber Attacks in 80 Countries

Since at least 2021, the federal government says, the "Rapper Bot" DDoS-for-hire botnet launched "large-scale cyber attacks."

Now, an Oregon man—Ethan Foltz, 22—has been accused of being behind the powerful botnet. How powerful and destructive was it? According to prosecutors, the botnet struck a "U.S. government network, a popular social media platform, and many U.S. tech companies." Among those facing outages was X, ITPro reported.

From April to August 2025, Rapper Bot "allegedly conducted over 370,000 attacks, targeting 18,000 unique victims," federal authorities alleged.

Investigators identified Foltz "as the alleged administrator of Rapper Bot," according to a statement from the U.S. Department of Justice.

The botnet planted malware on people's WiFi routers and other devices.

Rapper Bot, aka “Eleven Eleven Botnet” and “CowBot,” is a botnet that "primarily compromises devices like Digital Video Recorders (DVRS) or WiFi routers at scale by infecting those devices with specialized malware," the release says.

Clients of Rapper Bot "then issue commands to those infected victim devices, forcing them to send large volumes of 'Distributed Denial of Service' (DDoS) traffic to different victim computers and servers located throughout the world," the release says.

Prosecutors accuse Foltz and "co-conspirators" of monetizing the Rapper Bot by "providing select paying customers with access to one of the most sophisticated and powerful DDoS-for-hire botnets currently in existence."

The botnet hit victims in 80 countries, the U.S. Department of Justice says, "utilizing roughly 65,000 to 95,000 infected victim devices." The charges came down in the Alaskan office because some of the victims are located there, according to prosecutors.

"The criminal complaint details that a DDoS attack averaging over two Terabits per second lasting 30 seconds might cost a victim anywhere from $500 to $10,000," it says, adding that some of Foltz's customers used the botnet to launch "extortion demands."

On August 6, the government took "administrative control" of Rapper Bot after executing a search warrant at Foltz's house, the release says.

"Rapper Bot was one of the most powerful DDoS botnets to ever exist, but the outstanding investigatory work by DCIS cyber agents and support of my office and industry partners has put an end to Foltz’s time as administrator and effectively disrupted the activities of this transnational criminal group,” said U.S. Attorney Michael J. Heyman for the District of Alaska, in the release.

Foltz "is charged with one count of aiding and abetting computer intrusions. If convicted, Foltz faces a maximum penalty of 10 years in prison," the release says. He has no criminal history, according to Oregon Live.

That site says an affidavit accused Foltz of using the false name “Special Agent William Stevens Johnson III" online. He told authorities he suspended Rapper Bot customers who attacked X with the botnet, Oregon Live reported, adding that Foltz told authorities his partner was named "SlayKings."