Prosecutors charge man who allegedly used botnet to take down X this spring

An Oregon man has been charged in a federal complaint today on allegations of operating a botnet for hire that conducted cyberattacks beginning at least in 2021. Ethan Foltz has been accused of running Rapper Bot, also known as Eleven Eleven Botnet and CowBot, and using it to execute coordinated distributed denial of service (DDoS) attacks. The complaint claims that Rapper Bot was used to target victims in more than 80 countries, and since April 2025, it has reportedly conducted more than 370,000 attacks against 18,000 unique victims.

"Rapper Bot was one of the most powerful DDoS botnets to ever exist," US Attorney Michael J. Heyman for the District of Alaska said. "Our office remains committed to disrupting and dismantling cyber criminals that threaten internet security and infrastructure in the District of Alaska and across the United States."

One of Rapper Bot's alleged victims was X, which was taken down by a DDoS attack in March. At the time, owner Elon Musk made unsubstantiated claims about the attack being perpetrated by a "large, coordinated group and/or a country" and that it stemmed from IP addresses in Ukraine, although security researchers said it was possible the social network had left servers unsecured.