PORTLAND, Ore. (KOIN) – An Oregon man was charged in a federal complaint on Tuesday for allegedly leading large-scale cyberattacks across dozens of countries.

The U.S. Attorney’s Office for the District of Alaska announced 22-year-old Ethan Foltz of Eugene faces one count of aiding and abetting computer intrusions. If convicted, Foltz faces a maximum penalty of 10 years in prison.

Authorities allege Foltz is behind the “Rapper Bot” Distributed Denial of Service-for-hire Botnet, conducting cyberattacks since at least 2021.

According to the U.S. Attorney’s Office, “Rapper Bot,” also known as “Eleven Eleven Botnet,” and “CowBot,” is a Botnet that mainly compromises devices such as Digital Video Recorders or Wi-Fi routers by infecting the devices with malware.

Clients working with Rapper Bot then issue commands to victims devices to send large volumes of DDoS traffic to victim computers and servers around the world.

According to court documents, Foltz and his co-conspirators monetized Rapper Bot by providing paying customers with access “to one of the most sophisticated and powerful DDoS-for-hire Botnets currently in existence,” the U.S. Attorney’s Office said.

Authorities allege Rapper Bot targeted victims in more than 80 countries, including a U.S. government network, a social media platform and U.S. technology companies.

The lawsuit notes from April 2025 to present, Rapper Bot allegedly conducted more than 370,000 attacks that targeted 18,000 victims.

Authorities further allege that Rapper Bot used 65,000 to 95,000 infected victims’ devices to regularly conduct the DDoS attacks, which commonly measure between two to three Terabits per second. Authorities, however, allege that Rapper Bot’s largest attack may have exceeded six Terabits per second.

According to court documents, DDoS attacks have become more powerful, and impact victims finances through lost revenue, disgruntled customers, resources used to respond to attacks and bandwidth usage costs.

“The criminal complaint details that a DDoS attack averaging over two Terabits per second lasting 30 seconds might cost a victim anywhere from $500 to $10,000. It is also alleged that some Rapper Bot customers used extortion demands, leveraging the DDoS attack volumes of the Botnet to extort victims,” the U.S. Attorney’s Office for the District of Alaska explained.

On August 6, law enforcement executed a search warrant at Foltz’s Oregon home, noting authorities then obtained administrative control over Rapper Bot.

“Rapper Bot was one of the most powerful DDoS botnets to ever exist, but the outstanding investigatory work by (Defense Criminal Investigative Service) cyber agents and support of my office and industry partners has put an end to Foltz’s time as administrator and effectively disrupted the activities of this transnational criminal group,” said U.S. Attorney Michael J. Heyman for the District of Alaska. “Our office remains committed to disrupting and dismantling cyber criminals that threaten internet security and infrastructure in the District of Alaska and across the United States.”

“Today’s announcement highlights the ongoing efforts by law enforcement to disrupt and dismantle emerging cyber threats targeting the Department of Defense and the defense industrial base,” added Special Agent in Charge Kenneth DeChellis of the Department of Defense Office of Inspector General, DCIS, Cyber Field Office. “The Rapper Bot malware was a clear threat, and the focused efforts of DCIS, our industry partners, and the federal prosecutors at the U.S. Attorney’s Office in Alaska, sends a clear signal to those who would harm the DoD’s personnel, infrastructure, and intellectual property, that their actions will come at a cost.”