Counterintelligence — 2026-04-16
Multinational Operation PowerOFF Seizes 53 DDoS-for-Hire Domains, Makes 4 Arrests Across 21 Countries
Law enforcement from 21 countries led by
Analysis
The 21-country PowerOFF tempo, anchored by Europol's own release and corroborated without divergence by CyberScoop, is crystallizing as the template for dismantling below-threshold cybercrime infrastructure that state actors rent without attribution risk. The 3 million account records extracted from seized databases hand FBI, NCA, and BKA analytic teams a rare attribution corpus that very likely seeds parallel counterintelligence leads against nation-state booter rental within the next 60 days. The four arrests understate the actual pressure vector: stripping the customer-trust layer from booter markets is likely to raise effective cost per DDoS campaign for pro-Russian hacktivist fronts targeting Baltic and Polish infrastructure within the coming weeks. The ecosystem has, however, previously reconstituted within months of comparable seizure actions, and without follow-on treasury designations against operators and hosting providers, the disruption may prove transitory rather than structural.
The 21-country PowerOFF tempo, anchored by Europol's own release and corroborated without divergence by CyberScoop, is crystallizing as the template for dismantling below-threshold cybercrime infrastructure that state actors rent without attribution risk. The 3 million account records extracted from seized databases hand FBI, NCA, and BKA analytic teams a rare attribution corpus that very likely seeds parallel counterintelligence leads against nation-state booter rental within the next 60 days. The four arrests understate the actual pressure vector: stripping the customer-trust layer from booter markets is likely to raise effective cost per DDoS campaign for pro-Russian hacktivist fronts targeting Baltic and Polish infrastructure within the coming weeks. The ecosystem has, however, previously reconstituted within months of comparable seizure actions, and without follow-on treasury designations against operators and hosting providers, the disruption may prove transitory rather than structural.