The National Crime Agency (NCA) has taken control of Digitalstress, a DDoS rental service responsible for tens of thousands of attacks worldwide every week.

The disruption of digitalstress.su was carried out in conjunction with the Police Service of Northern Ireland (PSNI). This action followed the arrest of a suspected administrator of the site earlier this month. The NCA took over the site and replaced the content with a page warning users that their details had been captured by the police. This was made possible by the creation of a mirror site that users were redirected to.

In addition, the NCA was given both covert and overt access to communication platforms where DDoS attacks were discussed, warning users that there was no safe place for cybercriminals to talk about their activities.

DDoS attacks and their consequences

Distributed denial of service (DDoS) attacks aim to overload websites and take them offline. They are illegal in the UK under the Computer Misuse Act 1990. DDoS-for-hire or “booter” services allow users to create accounts within minutes and order DDoS attacks. These attacks can cause significant damage to businesses and critical national infrastructure, and prevent people from using essential public services such as fire, police or ambulance services.

Digitalstress administrators chose to host the service under a .su domain, an old Soviet domain used by many criminal agencies, believing it would be a hindrance to law enforcement. However, the NCA has shown that such domains are vulnerable and can be exploited to stop criminal activity and identify those responsible.

Follow-up and international cooperation

User information is now analyzed by the NCA for legal action and data on foreign users is passed on to international law enforcement agencies.

Paul Foster, deputy director of the NCA’s National Cyber ​​Crime Unit, said: “Booter services are an attractive entry point into cybercrime, allowing people with little technical knowledge to easily commit cybercrime. “Anyone who used these services while our mirror site was active has now identified themselves to law enforcement agencies worldwide.”

Detective Chief Inspector Paul Woods of the Police Service of Northern Ireland added: “This is an excellent example of cooperation. We will continue to work with our law enforcement partners to disrupt the activities of those who use cyber technology to cause harm locally or globally.”

This action is part of Operation Power Off, the ongoing coordinated international response targeting criminal DDoS-for-hire infrastructures worldwide.