USDW
Company Details
Linkedin ID:
deptofwar
Website:
Employees number:
65,996
Number of followers:
1,579,395
NAICS:
92811
Industry Type:
Homepage:
war.gov
IP Addresses:
0
Company ID:
UNI_5481001
Scan Status:
In-progress
United States Department of War Company CyberSecurity Posture
war.gov
The mission of the Department of War is to provide military forces necessary to protect the security of our country. The U.S. military defends the homeland, deters adversaries, and builds security around the world by projecting U.S. influence and working with allies and partners. In case deterrence fails, the U.S. military is prepared to fight and win decisively against any adversary. Headed by Secretary of War Pete Hegseth, the Department is not only in charge of the military, it also employs a topnotch civilian workforce. With more than 1.3 million men and women on active duty, and 742,000 civilian personnel, we are also the nation's largest employer. The Pentagon, headquarters of the Department of War, is one of the largest office buildings in the world. Built in 1941 by the U.S. Army, the Pentagon has 17.5 miles of corridors yet it takes only seven minutes to walk between any two points in the building. Department of War personnel are the backbone of America’s national security. They represent the diverse makeup of our nation and support not only those on active duty but also families, veterans, and retirees through education, training, and benefit programs. Anything you want to do – on land, sea, air, or space -- you can do in service to your nation by joining the Department of War. Search for Jobs and Internships at USAJobs.gov. http://dodcio.defense.gov/SocialMedia/UserAgreement.aspx
United States Department of War A.I CyberSecurity Scoring
USDW Risk Score (AI oriented)Between 800 and 849
USDW
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
USDW Global Score (TPRM)XXXX
USDW
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
USDW Company CyberSecurity News & History
Past Incidents
11
Attack Types
3
United States Department of Defense
Cyber Attack
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: The computer system of the US defense department was targeted by a cyber attack after a computer hacker stole hundreds of user accounts from a US military communications system. Additionally, NCA investigators discovered that Caffrey's machines were used to open and run a pseudonymous online messaging account connected to the attack. The compromised data includes usernames and email addresses of more than 800 users of a satellite communications system, as well as of about 30,000 satellite phones. According to the DoD, it cost about $628,000 to repair the harm the hacker's infiltration caused.
U.S. Department of Defense (DoD)
Cyber Attack
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: The U.S. Department of Defense (DoD) was among the targets of **Ethan Foltz’s 'Rapper Bot' botnet**, a highly sophisticated DDoS-for-hire network capable of generating **2–3 terabits per second** of malicious traffic. The botnet, comprising **65,000–95,000 infected devices** (including routers and DVRs), was used to overwhelm DoD networks, potentially disrupting critical operations, communications, or defense infrastructure. While the exact operational impact remains undisclosed, DDoS attacks of this scale can **degrade system performance, cause outages, or impede access to vital services**, posing risks to national security. The DoD’s **Defense Industrial Base (DIB)**—a network of contractors and suppliers essential to military readiness—was also at risk, as the botnet targeted broader defense-related entities. Law enforcement intervention in **August 2024** halted the attacks, but the incident underscores vulnerabilities in government cyber defenses. The DoD’s **Special Agent in Charge Kenneth DeChellis** emphasized the threat’s severity, linking it to broader criminal efforts to undermine defense cybersecurity (Operation PowerOFF).
The US Department of Defense
Cyber Attack
Rankiteo Explanation
Attack that could bring to a war
Description: In 2022, a significant cyberattack targeted the KA-Sat consumer satellite broadband service, affecting the satellites and disrupting broadband services. Such a breach highlights the vulnerabilities and potential risks to national security posed by cyber threats to key satellite infrastructure. The severity of these disruptions in space has implications that can transcend beyond military communications, impacting various aspects of civilian life and the expansive global market that relies on satellite technology. The US military's Commercial Augmentation Space Reserve (CASR) initiative aims to improve resilience against such threats by partnering with the commercial space industry.
United States Department of Defense
Cyber Attack
Rankiteo Explanation
Attack that could injure or kill people
Description: The computer system of the US defense department building, Pentagon suffered a cyberattack that resulted in a data breach incident. The attack resulted in major disruptions to the 4,000 military and civilian personnel who work for the Joint Chiefs of Staff. US officials investigated the incident and worked to restore its systems.
United States Department of Defense
Cyber Attack
Rankiteo Explanation
Attack threatening the economy of a geographical region
Description: A California man along with his teammates targeted the United States Department of Defense in a sophisticated phishing attack. The crew scammed the Dod vendors by sending emails and presenting them with a lookalike login page of GSA and capturing their login credentials and hacking their accounts and routing payments to the shell entity they had set up for the attack. The attackers apparently collected about $23.5 million in payments from DoD before the scam and all the conspirators were put behind the bar.
US Department of Defense (DoD)
Cyber Attack
Rankiteo Explanation
Attack that could bring to a war
Description: The **US Department of Defense (DoD)** was among the victims of **Rapper Bot**, a sophisticated DDoS-for-hire botnet allegedly administered by Ethan Foltz. The botnet, leveraging **65,000–95,000 infected devices** (e.g., DVRs, WiFi routers), executed **multi-terabit DDoS attacks**, with some exceeding **6 Tbps**, targeting over **18,000 unique victims** across **80+ countries**, including critical DoD networks. These attacks disrupted operations, incurred financial losses (e.g., **$500–$10,000 per 30-second 2+ Tbps attack**), and strained resources for mitigation. Extortion demands were also linked to Rapper Bot, compounding the threat. The DoD’s **defense industrial base, infrastructure, and intellectual property** were at risk, prompting a coordinated law enforcement response to dismantle the botnet. The incident underscores vulnerabilities in **military and government cybersecurity**, with potential cascading effects on national security if left unchecked. The botnet’s scale and targeting of **DoD systems** elevate the severity, given its role in safeguarding classified data and mission-critical operations.
U.S. Department of Defense (DoD)
Cyber Attack
Rankiteo Explanation
Attack threatening the economy of geographical region
Description: The **U.S. Department of Defense (DoD)** was among the high-profile targets of **RapperBot (Eleven Eleven Botnet)**, a Mirai-based DDoS-for-hire botnet allegedly operated by Ethan Foltz. Between April and August 2024, the botnet executed over **370,000 attacks**, including strikes against **DoD networks and defense-related services**, with some exceeding **6 Tbps**—capable of crippling critical infrastructure. While the article does not specify the exact operational damage (e.g., outages, data breaches, or financial losses), the DoD’s inclusion as a target suggests **disruption to military or defense communications, potential degradation of network availability, and heightened vulnerability to follow-on cyber intrusions**. The botnet’s scale and its **direct targeting of government defense systems** imply risks beyond financial costs, including **compromised national security posture, erosion of public trust in defense cyber resilience, and possible cascading effects on allied networks**. The DoD’s involvement in **Operation PowerOFF**—a multi-agency takedown—underscores the severity of the threat. Though no ransomware or data exfiltration was reported, the **sustained, high-volume DDoS attacks** could have **delayed mission-critical operations, strained cybersecurity resources, and exposed gaps in perimeter defenses**, particularly if combined with extortion demands (as seen with other victims like Chinese gambling platforms).
US Defense Department
Cyber Attack
Rankiteo Explanation
Attack that could injure or kill people
Description: US military trials of the autonomous robotic gun system 'Bullfrog,' developed by Allen Control Systems, indicate a shift towards more precise small arms fire for counter-drone measures. Utilizing a 7.62-mm M240 machine gun, the Bullfrog incorporates AI and computer vision software to accurately target and eliminate drone threats. The successful testing suggests an improvement in protective measures for US troops against low-cost adversarial drones, enhancing battlefield safety and tactical capabilities. With the potential to be the first lethal autonomous weapon in the US military's arsenal, the Bullfrog stands as a testament to the integration of advanced technology in defense strategies.
United States Department of Defense
Data Leak
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: The 25-year-old Sutton Coldfield, England hacker Sean Caffrey entered a guilty plea to obtaining user accounts from a communications system used by the US military. The NCA claims that the guy acknowledged in Birmingham Crown Court to having stolen data from 800 customers of a satellite communications system. According to the computer hacker, a US military communications system contained hundreds of user accounts that were stolen. In addition to almost 30,000 satellite phones, the hacker gained access to and took the ranks, usernames, and email addresses of over 800 subscribers of a satellite communications system.
Department of Defense
Vulnerability
Rankiteo Explanation
Attack without any consequences
Description: The Department of Defense's enterprise Identity Credential and Access Management initiative is transitioning from traditional security models to modern authentication frameworks to address critical vulnerabilities identified in federal systems. This move is essential to counter evolving cyber threats without compromising collaborative capabilities. The initiative includes the creation of the DoD ICAM Federation Hub, which allows identity systems across military branches to provide cross-system security enforcement, eliminating delays and connection issues for warfighters.
US Department of Defense (DoD)
Vulnerability
Rankiteo Explanation
Attack limited on finance or reputation
Description: The US Department of Defense (DoD) exposed confidential **stream keys**—unique identifiers used for broadcasting on social media platforms like Facebook, YouTube, and X (Twitter)—on its public **Defense Visual Information Distribution Service (DVIDS)** website for years. These keys, if obtained by attackers, could allow unauthorized hijacking of official DoD livestreams, enabling malicious actors to broadcast fake or harmful content under the guise of the Pentagon. The vulnerability was discovered by *The Intercept*, which found that keys for high-profile events—such as the **2018 US Cyber Command change of command ceremony**, **2023 West Point commencement**, and a **2024 National Guard event with Defense Secretary Pete Hegseth**—were publicly accessible via simple URL sequencing or search queries.While the DoD claims the issue has been resolved by revoking old keys and restricting future exposure, the oversight highlights systemic security lapses under current leadership, compounded by prior controversies like **Signalgate** and the use of **China-based employees for Azure cloud support**. The exposure risks **disinformation campaigns**, **reputational damage**, and **potential exploitation by adversarial nation-states**, though no confirmed breaches occurred. The incident underscores persistent vulnerabilities in handling sensitive credentials within a critical government agency.
USDW Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for USDW
Incidents vs Armed Forces Industry Average (This Year)
No incidents recorded for United States Department of War in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for United States Department of War in 2025.
Incident Types USDW vs Armed Forces Industry Avg (This Year)
No incidents recorded for United States Department of War in 2025.
Incident History — USDW (X = Date, Y = Severity)
USDW cyber incidents detection timeline including parent company and subsidiaries
USDW Company Subsidiaries
The mission of the Department of War is to provide military forces necessary to protect the security of our country. The U.S. military defends the homeland, deters adversaries, and builds security around the world by projecting U.S. influence and working with allies and partners. In case deterrence fails, the U.S. military is prepared to fight and win decisively against any adversary. Headed by Secretary of War Pete Hegseth, the Department is not only in charge of the military, it also employs a topnotch civilian workforce. With more than 1.3 million men and women on active duty, and 742,000 civilian personnel, we are also the nation's largest employer. The Pentagon, headquarters of the Department of War, is one of the largest office buildings in the world. Built in 1941 by the U.S. Army, the Pentagon has 17.5 miles of corridors yet it takes only seven minutes to walk between any two points in the building. Department of War personnel are the backbone of America’s national security. They represent the diverse makeup of our nation and support not only those on active duty but also families, veterans, and retirees through education, training, and benefit programs. Anything you want to do – on land, sea, air, or space -- you can do in service to your nation by joining the Department of War. Search for Jobs and Internships at USAJobs.gov. http://dodcio.defense.gov/SocialMedia/UserAgreement.aspx
Loading...
USDW Similar Companies
Marine Corps Recruiting
This is the Official LinkedIn Page of Marine Corps Recruiting. We make Marines. We win our nation's battles. We develop quality citizens. These are the promises the Marine Corps makes to our nation and to our Marines. The core values that guide us, and the leadership skills that enable us, not on
Army National Guard
Welcome to the Army National Guard's page on LinkedIn. The Army National Guard, also known as the National Guard, is one component of The Army (which consists of the Active Army, the Army National Guard, and the Army Reserve). National Guard Soldiers serve both community and country. Our versatili
Israel Defense Forces
The Israel Defense Forces (IDF) is the military of the State of Israel, responsible for the nation's defense and security. Founded in 1948, the IDF ranks among the most battle-tested armed forces in the world, having had to defend the country in six major wars. At the age of 18, men and women are
US Navy
The United States is a maritime nation, and the U.S. Navy protects America at sea. Alongside our allies and partners, we defend freedom, preserve economic prosperity, and keep the seas open and free. Our nation is engaged in long-term competition. To defend American interests around the globe, the U
Air Force Space Command
Air Force Space Command, activated Sept. 1, 1982, is a major command with headquarters at Peterson Air Force Base, Colo. AFSPC provides military focused space and cyberspace capabilities with a global perspective to the joint warfighting team. People More than 40,000 professionals assigned to 13
U.S. Navy Reserve
MISSION Throughout all 50 states and around the world, the Navy Reserve force delivers real-world capabilities and expertise to support the Navy mission — building a more lethal, warfighting culture focused on great power competition. VISION The Navy Reserve provides essential naval warfighting cap
United States Marine Corps
The United States Marine Corps (USMC) is a branch of the United States Armed Forces responsible for providing power projection, using the mobility of the United States Navy, by Congressional mandate, to deliver rapidly, combined-arms task forces on land, at sea, and in the air. The U.S. Marine Corps
U.S. Coast Guard
The mission of the U.S. Coast Guard is to protect the public, the environment, and U.S. economic interests — along the coast and our coastal borders, in the nation's ports and waterways, in international waters, or in any maritime region as required to support national security. As one of the six b
US Army Corps of Engineers
U.S. Army Corps of Engineers Mission: Provide vital public engineering services in peace and war to strengthen our Nation’s security, energize the economy, and reduce risks from disasters. Privacy Policy/Social Media Guidelines: https://www.usace.army.mil/SocialMedia/ U.S. Army Corps of Engineers
.png)
USDW CyberSecurity News
November 10, 2025 08:00 AM
The U.S. Department of War Issues New Cybersecurity Regulations — Mobilicom’s Secured Autonomy™ Framework is one of the First-to-Market Solutions Addressing these Regulations for Autonomous Systems
The U.S. Department of War's new Cybersecurity Risk Management Construct (“CSRMC”) underscores the urgent need for real-time cyber defense...
October 06, 2025 07:00 AM
US DoD Will Cut Back on Mandatory Cybersecurity Training
Mandatory Department training that isn't "directly linked to warfighting" will be reduced or consolidated, according to a new DoD memo.
October 03, 2025 07:00 AM
US Department of War reduces cybersecurity training, tells soldiers to focus on their mission
US Department of War reduces cybersecurity training, tells soldiers to focus on their mission · Department of Defense memo outlines a reduction...
October 03, 2025 07:00 AM
Pentagon relaxes military cybersecurity training
Cybersecurity training, beards, and body fat have something in common, according to the Pentagon. They're not helping the US military fight...
September 26, 2025 07:00 AM
US Department of War rolls out CSRMC to deliver real-time cyber defense
The U.S. Department of War (DoW) announced on Wednesday the implementation of a Cybersecurity Risk Management Construct (CSRMC),...
September 26, 2025 07:00 AM
Department of War Announces New Cybersecurity Risk Management Construct
The Department of War (DoW) has announced the implementation of a groundbreaking Cybersecurity Risk Management Construct (CSRMC),...
September 26, 2025 07:00 AM
US military unveils automated cybersecurity construct for modern warfare
Defence leaders describe the framework as a cultural shift towards cybersecurity at operational speed, designed to safeguard US...
September 16, 2025 07:00 AM
Commission on U.S. Cyber Force Generation
The CSIS Commission on U.S. Cyber Force Generation will convene leading experts to examine how the United States can best build a dedicated...
September 10, 2025 05:02 PM
DoD Notified of OPM Cybersecurity Incident
The U.S. Office of Personnel Management said a recent cybersecurity incident affecting its systems and data may have exposed the personal information of...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
USDW CyberSecurity History Information
Official Website of United States Department of War
The official website of United States Department of War is http://war.gov.
United States Department of War’s AI-Generated Cybersecurity Score
According to Rankiteo, United States Department of War’s AI-generated cybersecurity score is 811, reflecting their Good security posture.
How many security badges does United States Department of War’ have ?
According to Rankiteo, United States Department of War currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does United States Department of War have SOC 2 Type 1 certification ?
According to Rankiteo, United States Department of War is not certified under SOC 2 Type 1.
Does United States Department of War have SOC 2 Type 2 certification ?
According to Rankiteo, United States Department of War does not hold a SOC 2 Type 2 certification.
Does United States Department of War comply with GDPR ?
According to Rankiteo, United States Department of War is not listed as GDPR compliant.
Does United States Department of War have PCI DSS certification ?
According to Rankiteo, United States Department of War does not currently maintain PCI DSS compliance.
Does United States Department of War comply with HIPAA ?
According to Rankiteo, United States Department of War is not compliant with HIPAA regulations.
Does United States Department of War have ISO 27001 certification ?
According to Rankiteo,United States Department of War is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of United States Department of War
United States Department of War operates primarily in the Armed Forces industry.
Number of Employees at United States Department of War
United States Department of War employs approximately 65,996 people worldwide.
Subsidiaries Owned by United States Department of War
United States Department of War presently has no subsidiaries across any sectors.
United States Department of War’s LinkedIn Followers
United States Department of War’s official LinkedIn profile has approximately 1,579,395 followers.
NAICS Classification of United States Department of War
United States Department of War is classified under the NAICS code 92811, which corresponds to National Security.
United States Department of War’s Presence on Crunchbase
No, United States Department of War does not have a profile on Crunchbase.
United States Department of War’s Presence on LinkedIn
Yes, United States Department of War maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/deptofwar.
Cybersecurity Incidents Involving United States Department of War
As of November 27, 2025, Rankiteo reports that United States Department of War has experienced 11 cybersecurity incidents.
Number of Peer and Competitor Companies
United States Department of War has an estimated 779 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at United States Department of War ?
Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Data Leak and Cyber Attack.
What was the total financial impact of these incidents on United States Department of War ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $24.63 million.
How does United States Department of War detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an recovery measures with us officials investigated the incident and worked to restore its systems, and remediation measures with modernization of authentication frameworks, implementation of icam systems, and enhanced monitoring with real-time threat detection, and and third party assistance with international law enforcement (operation poweroff), and and containment measures with search warrant execution at foltz's residence, containment measures with seizure of administrative control over rapper bot botnet, containment measures with disruption of ddos infrastructure, and remediation measures with shutdown of 27 ddos-for-hire domains (december 2024), remediation measures with arrests of operators, and communication strategy with public announcement by u.s. attorney's office (district of alaska), communication strategy with press release highlighting operation poweroff, and and third party assistance with industry partners (e.g., cloudflare), and and containment measures with botnet disruption, containment measures with arrest of administrator, and communication strategy with public announcement by us attorney's office, and and third party assistance with aws, third party assistance with akamai, third party assistance with cloudflare, third party assistance with google, third party assistance with digitalocean, third party assistance with flashpoint, third party assistance with paypal, third party assistance with unit 221b, and and containment measures with seizure of command-and-control servers, containment measures with disruption of malicious infrastructure, and communication strategy with public announcement by doj, communication strategy with aws linkedin post, and enhanced monitoring with aws threat detection tools, and and containment measures with removal of publicly exposed stream keys, containment measures with discontinuation of old key-sharing practices, and remediation measures with generation of new stream keys, remediation measures with updated key distribution protocol, and communication strategy with public statement to *the register*, communication strategy with acknowledgment of fix..
Incident Details
Can you provide details on each incident ?
Title: Pentagon Cyberattack and Data Breach
Description: The computer system of the US defense department building, Pentagon suffered a cyberattack that resulted in a data breach incident.
Type: Cyberattack and Data Breach
Title: Phishing Attack on United States Department of Defense
Description: A California man along with his teammates targeted the United States Department of Defense in a sophisticated phishing attack. The crew scammed the Dod vendors by sending emails and presenting them with a lookalike login page of GSA and capturing their login credentials and hacking their accounts and routing payments to the shell entity they had set up for the attack. The attackers apparently collected about $23.5 million in payments from DoD before the scam and all the conspirators were put behind the bar.
Type: Phishing
Attack Vector: Email and fake login page
Vulnerability Exploited: Human vulnerability through phishing
Threat Actor: A California man and his teammates
Motivation: Financial gain
Title: US Defense Department Cyber Attack
Description: The computer system of the US defense department was targeted by a cyber attack after a computer hacker stole hundreds of user accounts from a US military communications system.
Type: Cyber Attack
Attack Vector: Stolen User Accounts
Threat Actor: Computer Hacker
Title: Hacker Sean Caffrey Pleads Guilty to Stealing US Military Satellite Communication Data
Description: Sean Caffrey, a 25-year-old hacker from Sutton Coldfield, England, pleaded guilty to stealing user accounts from a communications system used by the US military. The hacker obtained data from 800 customers of a satellite communications system, including ranks, usernames, and email addresses, as well as access to almost 30,000 satellite phones.
Type: Data Breach
Attack Vector: Unauthorized Access
Threat Actor: Sean Caffrey
Title: KA-Sat Satellite Broadband Service Cyberattack
Description: In 2022, a significant cyberattack targeted the KA-Sat consumer satellite broadband service, affecting the satellites and disrupting broadband services. Such a breach highlights the vulnerabilities and potential risks to national security posed by cyber threats to key satellite infrastructure. The severity of these disruptions in space has implications that can transcend beyond military communications, impacting various aspects of civilian life and the expansive global market that relies on satellite technology. The US military's Commercial Augmentation Space Reserve (CASR) initiative aims to improve resilience against such threats by partnering with the commercial space industry.
Date Detected: 2022
Type: Cyberattack
Title: US Military Trials of Autonomous Robotic Gun System 'Bullfrog'
Description: US military trials of the autonomous robotic gun system 'Bullfrog,' developed by Allen Control Systems, indicate a shift towards more precise small arms fire for counter-drone measures. Utilizing a 7.62-mm M240 machine gun, the Bullfrog incorporates AI and computer vision software to accurately target and eliminate drone threats. The successful testing suggests an improvement in protective measures for US troops against low-cost adversarial drones, enhancing battlefield safety and tactical capabilities. With the potential to be the first lethal autonomous weapon in the US military's arsenal, the Bullfrog stands as a testament to the integration of advanced technology in defense strategies.
Type: Military Technology Advancement
Motivation: Enhancing protective measures for US troops against low-cost adversarial drones
Title: Department of Defense Enterprise Identity Credential and Access Management Initiative
Description: The Department of Defense’s enterprise Identity Credential and Access Management initiative is modernizing authentication frameworks to address critical vulnerabilities in federal systems. The shift from traditional security models to modern ICAM systems includes secure authentication, access control, recertification, automated account provisioning, and separation of duties.
Date Publicly Disclosed: 06-10-25
Type: Security Vulnerability
Vulnerability Exploited: Critical vulnerabilities in federal systems
Motivation: Enhancing cyber defense capabilities
Title: Federal Charges Filed Against Oregon Man for Orchestrating 'Rapper Bot' DDoS Botnet Attacks
Description: Ethan Foltz, 22, allegedly developed the 'Rapper Bot' botnet, a sophisticated DDoS-for-hire service infecting 65,000–95,000 devices (e.g., DVRs, WiFi routers) to conduct large-scale DDoS attacks (2–3 Tbps) targeting victims in over 80 countries, including U.S. government networks, social media platforms, and tech companies. Authorities disrupted the botnet on August 6, 2024, as part of Operation PowerOFF. Foltz faces up to 10 years in prison if convicted of aiding and abetting computer intrusions.
Date Publicly Disclosed: 2024-08-06
Date Resolved: 2024-08-06
Type: Distributed Denial of Service (DDoS)
Attack Vector: Malware-infected IoT devices (DVRs, WiFi routers)DDoS-for-hire service
Vulnerability Exploited: Unsecured IoT devicesDefault/weak credentialsLack of device patching
Threat Actor: Name: Ethan FoltzLocation: Eugene, Oregon, USAAge: 22Nationality: AmericanMotivation: ['Financial gain (DDoS-for-hire)', 'Criminal enterprise']
Motivation: Financial profitDisruption of servicesCriminal reputation
Title: Rapper Bot DDoS-for-Hire Botnet Admin Charged for Large-Scale Cyberattacks
Description: A 22-year-old Oregon man, Ethan Foltz, has been charged with administering the Rapper Bot DDoS-for-hire botnet, which allegedly launched multi-terabit attacks across 80+ countries. The botnet compromised devices like DVRs and WiFi routers, infecting them with specialized malware to conduct DDoS attacks averaging 2-3 Tbps, with some exceeding 6 Tbps. Over 370,000 attacks targeted 18,000 unique victims, including a US government network, a social media platform, and multiple US tech companies. Victims faced financial losses, extortion demands, and operational disruptions.
Date Publicly Disclosed: 2024-08-19
Type: DDoS Attack
Attack Vector: BotnetMalware Infection (DVRs, WiFi Routers)DDoS-for-Hire Service
Vulnerability Exploited: Unsecured IoT Devices (DVRs, WiFi Routers)Lack of Device Hardening
Threat Actor: Name: Ethan FoltzAffiliation: Rapper Bot BotnetLocation: Oregon, USAMotivation: ['Financial Gain', 'Cybercrime-as-a-Service']Status: Charged (Aiding and Abetting Computer Intrusions)
Motivation: Financial GainExtortionCybercrime-as-a-Service
Title: Takedown of RapperBot (Eleven Eleven Botnet / CowBot) DDoS Botnet and Arrest of Alleged Operator Ethan Foltz
Description: RapperBot, a Mirai-based botnet-for-hire responsible for over 370,000 DDoS attacks across 18,000 victims in 80+ countries, was dismantled by federal authorities in Operation PowerOFF. Its alleged operator, Ethan Foltz (22) of Eugene, Oregon, was arrested on August 6, 2024. The botnet, capable of attacks exceeding 6 Tbps, targeted entities ranging from U.S. government/defense networks to social media platforms and gambling sites, with some victims extorted. The takedown involved international law enforcement and private-sector collaboration (AWS, Akamai, Cloudflare, etc.). Foltz faces up to 10 years in prison if convicted of aiding computer intrusions.
Date Publicly Disclosed: 2024-08-06
Date Resolved: 2024-08-06
Type: DDoS Attack
Attack Vector: Mirai-based BotnetDDoS-for-Hire ServiceCompromised IoT Devices
Vulnerability Exploited: Default/Weak Credentials (Mirai)Unpatched IoT Devices
Threat Actor: Name: Ethan FoltzLocation: Eugene, Oregon, USAAge: 22Nationality: American
Motivation: Financial Gain (Botnet-for-Hire)ExtortionCybercrime-as-a-Service
Title: US Department of Defense Social Media Stream Key Exposure
Description: The US Department of Defense (DoD) routinely left its social media accounts (Facebook, YouTube, X/Twitter) vulnerable to hijacking by publicly exposing stream keys—unique, confidential identifiers used for broadcasting content—on its Defense Visual Information Distribution Service (DVIDS) website. These keys, if obtained by attackers, could allow unauthorized parties to broadcast malicious or fraudulent content via the DoD's official channels. The issue was discovered by *The Intercept* and spanned multiple years, affecting high-profile events such as the U.S. Cyber Command change of command ceremony (2018), West Point commencement (2023), and a National Guard event in August 2024. The DoD confirmed the vulnerability has since been remediated by ceasing the public upload of stream keys and implementing new keys.
Date Publicly Disclosed: 2024-09-02
Date Resolved: 2024-09-02
Type: Data Exposure
Attack Vector: Publicly Accessible Stream KeysImproper Access ControlsWeb Portal Misconfiguration
Vulnerability Exploited: Exposed Stream Keys (YouTube, Facebook, X/Twitter)Sequentially Numbered Webcast URLsLack of Authentication for DVIDS Portal
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Email, Exploited IoT devices (DVRs, WiFi routers), Compromised IoT Devices (DVRs, WiFi Routers) and Compromised IoT Devices (Mirai Exploits).
Impact of the Incidents
What was the impact of each incident ?
Incident : Cyberattack and Data Breach UNI102224422
Downtime: Major disruptions
Operational Impact: Major disruptions to 4,000 military and civilian personnel who work for the Joint Chiefs of Staff
Incident : Cyber Attack UNI1235311022
Financial Loss: $628,000
Data Compromised: Usernames and email addresses of more than 800 users of a satellite communications system, as well as of about 30,000 satellite phones.
Systems Affected: US military communications system
Incident : Data Breach UNI954261123
Data Compromised: Ranks, Usernames, Email addresses, Satellite phone access
Systems Affected: satellite communications system
Incident : Cyberattack DEP902070724
Systems Affected: satellitesbroadband services
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Systems Affected: U.S. government networkSocial media platformU.S. tech companiesVictims in 80+ countries
Operational Impact: Service disruptionsBandwidth overload (2–3 Tbps traffic)Potential denial of critical services
Brand Reputation Impact: Potential erosion of trust in targeted organizationsNegative publicity for DDoS-for-hire ecosystem
Legal Liabilities: Federal charges for aiding and abetting computer intrusions (10-year max sentence)
Incident : DDoS Attack DEP445082225
Systems Affected: Government NetworksSocial Media PlatformsTech CompaniesIoT Devices (DVRs, WiFi Routers)
Operational Impact: Service DisruptionsBandwidth OverloadResource Drain for Mitigation
Revenue Loss: True
Customer Complaints: True
Incident : DDoS Attack DEP539082225
Financial Loss: Estimated $500–$10,000 per 2+ Tbps attack (30-second duration)
Systems Affected: US Government NetworksDefense-Related ServicesSocial Media PlatformsChinese Gambling Outfits
Operational Impact: Service DisruptionsDenial-of-Service
Brand Reputation Impact: Potential Reputation Damage for Targets
Incident : Data Exposure DEP0792107090925
Data Compromised: Stream keys (confidential broadcast identifiers)
Systems Affected: DVIDS WebsiteDoD Social Media Accounts (YouTube, Facebook, X/Twitter)
Operational Impact: Risk of Unauthorized Livestream HijackingPotential for Misinformation or Malicious Broadcasts
Brand Reputation Impact: Potential Erosion of Public TrustPerception of Lax Cybersecurity Practices
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $2.24 million.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Login credentials, Usernames, Email Addresses, , Ranks, Usernames, Email Addresses, Satellite Phone Access, , Stream Keys (Broadcast Credentials) and .
Which entities were affected by each incident ?
Incident : Cyberattack and Data Breach UNI102224422
Entity Name: Pentagon
Entity Type: Government
Industry: Defense
Location: United States
Incident : Phishing UNI141212522
Entity Name: United States Department of Defense
Entity Type: Government
Industry: Defense
Location: United States
Incident : Cyber Attack UNI1235311022
Entity Name: US Defense Department
Entity Type: Government
Industry: Defense
Location: United States
Incident : Data Breach UNI954261123
Entity Name: US Military
Entity Type: Government
Industry: Defense
Location: United States
Customers Affected: 800
Incident : Cyberattack DEP902070724
Entity Name: KA-Sat
Entity Type: Consumer Satellite Broadband Service
Industry: Telecommunications
Incident : Military Technology Advancement DEP001112324
Entity Name: Allen Control Systems
Entity Type: Company
Industry: Defense
Incident : Security Vulnerability DEP306061125
Entity Name: Department of Defense
Entity Type: Government
Industry: Defense
Location: United States
Size: Large
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Entity Name: U.S. Government Network
Entity Type: Government
Industry: Public Sector
Location: USA
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Entity Name: Unnamed Social Media Platform
Entity Type: Private Company
Industry: Technology/Social Media
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Entity Name: Unnamed U.S. Tech Companies
Entity Type: Private Company
Industry: Technology
Location: USA
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Entity Name: Victims in 80+ Countries
Entity Type: Private Companies, Government Entities, Individuals
Location: Global
Incident : DDoS Attack DEP445082225
Entity Name: US Government Network
Entity Type: Government
Industry: Public Sector
Location: USA
Incident : DDoS Attack DEP445082225
Entity Name: Unnamed Social Media Platform
Entity Type: Private Company
Industry: Technology/Social Media
Incident : DDoS Attack DEP445082225
Entity Name: Multiple US Tech Companies
Entity Type: Private Companies
Industry: Technology
Location: USA
Incident : DDoS Attack DEP539082225
Entity Name: U.S. Department of Defense
Entity Type: Government
Industry: Defense/Military
Location: USA
Incident : DDoS Attack DEP539082225
Entity Name: Unnamed Social Media Platforms
Entity Type: Private Sector
Industry: Technology/Social Media
Location: Global
Incident : DDoS Attack DEP539082225
Entity Name: Chinese Gambling Outfits
Entity Type: Private Sector
Industry: Gambling
Location: China
Incident : DDoS Attack DEP539082225
Entity Name: 18,000+ Victims Across 80+ Countries
Entity Type: Mixed (Public/Private)
Industry: Multiple
Location: Global
Incident : Data Exposure DEP0792107090925
Entity Name: U.S. Department of Defense (DoD)
Entity Type: Government Agency
Industry: Defense/Military
Location: United States
Incident : Data Exposure DEP0792107090925
Entity Name: Defense Visual Information Distribution Service (DVIDS)
Entity Type: Military Media Portal
Industry: Defense/Military
Location: United States
Incident : Data Exposure DEP0792107090925
Entity Name: U.S. Cyber Command
Entity Type: Military Subcommand
Industry: Defense/Cybersecurity
Location: United States
Incident : Data Exposure DEP0792107090925
Entity Name: West Point (U.S. Military Academy)
Entity Type: Educational Institution
Industry: Defense/Education
Location: United States
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Cyberattack and Data Breach UNI102224422
Recovery Measures: US officials investigated the incident and worked to restore its systems
Incident : Security Vulnerability DEP306061125
Remediation Measures: Modernization of authentication frameworks, implementation of ICAM systems
Enhanced Monitoring: Real-time threat detection
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Incident Response Plan Activated: True
Third Party Assistance: International Law Enforcement (Operation Poweroff).
Containment Measures: Search warrant execution at Foltz's residenceSeizure of administrative control over Rapper Bot botnetDisruption of DDoS infrastructure
Remediation Measures: Shutdown of 27 DDoS-for-hire domains (December 2024)Arrests of operators
Communication Strategy: Public announcement by U.S. Attorney's Office (District of Alaska)Press release highlighting Operation PowerOFF
Incident : DDoS Attack DEP445082225
Incident Response Plan Activated: True
Third Party Assistance: Industry Partners (E.G., Cloudflare).
Containment Measures: Botnet DisruptionArrest of Administrator
Communication Strategy: Public Announcement by US Attorney's Office
Incident : DDoS Attack DEP539082225
Incident Response Plan Activated: True
Third Party Assistance: Aws, Akamai, Cloudflare, Google, Digitalocean, Flashpoint, Paypal, Unit 221B.
Containment Measures: Seizure of Command-and-Control ServersDisruption of Malicious Infrastructure
Communication Strategy: Public Announcement by DOJAWS LinkedIn Post
Enhanced Monitoring: AWS Threat Detection Tools
Incident : Data Exposure DEP0792107090925
Incident Response Plan Activated: True
Containment Measures: Removal of Publicly Exposed Stream KeysDiscontinuation of Old Key-Sharing Practices
Remediation Measures: Generation of New Stream KeysUpdated Key Distribution Protocol
Communication Strategy: Public Statement to *The Register*Acknowledgment of Fix
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through International law enforcement (Operation PowerOFF), , Industry Partners (e.g., Cloudflare), , AWS, Akamai, Cloudflare, Google, DigitalOcean, Flashpoint, PayPal, Unit 221B, .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Phishing UNI141212522
Type of Data Compromised: Login credentials
Incident : Cyber Attack UNI1235311022
Type of Data Compromised: Usernames, Email addresses
Number of Records Exposed: 800 users, 30,000 satellite phones
Incident : Data Breach UNI954261123
Type of Data Compromised: Ranks, Usernames, Email addresses, Satellite phone access
Number of Records Exposed: 800
Personally Identifiable Information: usernamesemail addresses
Incident : Data Exposure DEP0792107090925
Type of Data Compromised: Stream keys (broadcast credentials)
Sensitivity of Data: High (Confidential Broadcast Access)
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Modernization of authentication frameworks, implementation of ICAM systems, Shutdown of 27 DDoS-for-hire domains (December 2024), Arrests of operators, , Generation of New Stream Keys, Updated Key Distribution Protocol, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by search warrant execution at foltz's residence, seizure of administrative control over rapper bot botnet, disruption of ddos infrastructure, , botnet disruption, arrest of administrator, , seizure of command-and-control servers, disruption of malicious infrastructure, , removal of publicly exposed stream keys, discontinuation of old key-sharing practices and .
Ransomware Information
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through US officials investigated the incident and worked to restore its systems.
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Regulations Violated: U.S. Computer Fraud and Abuse Act (CFAA), Potential violations of international cybercrime laws,
Legal Actions: Federal criminal charges (1 count: aiding and abetting computer intrusions),
Incident : DDoS Attack DEP445082225
Legal Actions: Criminal Charges (1 count of aiding and abetting computer intrusions),
Incident : DDoS Attack DEP539082225
Legal Actions: Criminal Charges (Aiding and Abetting Computer Intrusions),
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Federal criminal charges (1 count: aiding and abetting computer intrusions), , Criminal Charges (1 count of aiding and abetting computer intrusions), , Criminal Charges (Aiding and Abetting Computer Intrusions), .
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Cyberattack DEP902070724
Lessons Learned: The incident highlights the vulnerabilities and potential risks to national security posed by cyber threats to key satellite infrastructure.
Incident : Security Vulnerability DEP306061125
Lessons Learned: Importance of modernizing authentication and anti-phishing security, real-time threat detection capabilities
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Lessons Learned: Critical need for securing IoT devices against botnet recruitment, Effectiveness of international law enforcement collaboration (Operation PowerOFF) in disrupting DDoS-for-hire services, Importance of proactive monitoring for anomalous traffic patterns (2–3 Tbps DDoS attacks)
Incident : DDoS Attack DEP445082225
Lessons Learned: IoT device security vulnerabilities enable large-scale botnet formation., DDoS-for-hire services pose significant threats to critical infrastructure and businesses., Collaboration between law enforcement and private sector is critical for disrupting cybercrime operations.
Incident : DDoS Attack DEP539082225
Lessons Learned: Effectiveness of Public-Private Partnerships in Botnet Takedowns, Role of Hyperscale Cloud Providers (e.g., AWS) in Cybercrime Disruption, Ongoing Threat of DDoS-for-Hire Services Despite High-Profile Takedowns
Incident : Data Exposure DEP0792107090925
Lessons Learned: Public-facing portals must enforce strict access controls for sensitive credentials., Stream keys and similar broadcast identifiers should be treated as highly confidential., Regular audits of public websites for exposed credentials are critical, especially for high-profile organizations., Sequential or predictable URL structures can exacerbate exposure risks.
What recommendations were made to prevent future incidents ?
Incident : Cyberattack DEP902070724
Recommendations: The US military's Commercial Augmentation Space Reserve (CASR) initiative aims to improve resilience against such threats by partnering with the commercial space industry.
Incident : Security Vulnerability DEP306061125
Recommendations: Adopt modern ICAM systems, implement federated partnerships
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Recommendations: Implement default credential changes and regular patching for IoT devices, Deploy DDoS mitigation solutions (e.g., scrubbing centers, rate limiting), Enhance cross-border cybercrime investigations and information sharing, Public awareness campaigns on risks of DDoS-for-hire servicesImplement default credential changes and regular patching for IoT devices, Deploy DDoS mitigation solutions (e.g., scrubbing centers, rate limiting), Enhance cross-border cybercrime investigations and information sharing, Public awareness campaigns on risks of DDoS-for-hire servicesImplement default credential changes and regular patching for IoT devices, Deploy DDoS mitigation solutions (e.g., scrubbing centers, rate limiting), Enhance cross-border cybercrime investigations and information sharing, Public awareness campaigns on risks of DDoS-for-hire servicesImplement default credential changes and regular patching for IoT devices, Deploy DDoS mitigation solutions (e.g., scrubbing centers, rate limiting), Enhance cross-border cybercrime investigations and information sharing, Public awareness campaigns on risks of DDoS-for-hire services
Incident : DDoS Attack DEP445082225
Recommendations: Strengthen IoT device security (e.g., default credential changes, firmware updates)., Implement DDoS mitigation strategies (e.g., rate limiting, traffic scrubbing)., Enhance monitoring for botnet-related traffic patterns., Report extortion attempts to law enforcement immediately.Strengthen IoT device security (e.g., default credential changes, firmware updates)., Implement DDoS mitigation strategies (e.g., rate limiting, traffic scrubbing)., Enhance monitoring for botnet-related traffic patterns., Report extortion attempts to law enforcement immediately.Strengthen IoT device security (e.g., default credential changes, firmware updates)., Implement DDoS mitigation strategies (e.g., rate limiting, traffic scrubbing)., Enhance monitoring for botnet-related traffic patterns., Report extortion attempts to law enforcement immediately.Strengthen IoT device security (e.g., default credential changes, firmware updates)., Implement DDoS mitigation strategies (e.g., rate limiting, traffic scrubbing)., Enhance monitoring for botnet-related traffic patterns., Report extortion attempts to law enforcement immediately.
Incident : DDoS Attack DEP539082225
Recommendations: Strengthen IoT Device Security to Prevent Botnet Recruitment, Enhance DDoS Mitigation Capabilities for Critical Infrastructure, Continue Cross-Sector Collaboration for Cyber Threat DisruptionStrengthen IoT Device Security to Prevent Botnet Recruitment, Enhance DDoS Mitigation Capabilities for Critical Infrastructure, Continue Cross-Sector Collaboration for Cyber Threat DisruptionStrengthen IoT Device Security to Prevent Botnet Recruitment, Enhance DDoS Mitigation Capabilities for Critical Infrastructure, Continue Cross-Sector Collaboration for Cyber Threat Disruption
Incident : Data Exposure DEP0792107090925
Recommendations: Implement multi-factor authentication (MFA) for accessing media distribution portals., Conduct periodic red-team exercises to identify publicly exposed credentials., Enforce automated scanning for sensitive data (e.g., API keys, stream keys) in public repositories., Provide cybersecurity training for personnel managing public-facing media platforms., Adopt zero-trust principles for third-party integrations (e.g., social media APIs).Implement multi-factor authentication (MFA) for accessing media distribution portals., Conduct periodic red-team exercises to identify publicly exposed credentials., Enforce automated scanning for sensitive data (e.g., API keys, stream keys) in public repositories., Provide cybersecurity training for personnel managing public-facing media platforms., Adopt zero-trust principles for third-party integrations (e.g., social media APIs).Implement multi-factor authentication (MFA) for accessing media distribution portals., Conduct periodic red-team exercises to identify publicly exposed credentials., Enforce automated scanning for sensitive data (e.g., API keys, stream keys) in public repositories., Provide cybersecurity training for personnel managing public-facing media platforms., Adopt zero-trust principles for third-party integrations (e.g., social media APIs).Implement multi-factor authentication (MFA) for accessing media distribution portals., Conduct periodic red-team exercises to identify publicly exposed credentials., Enforce automated scanning for sensitive data (e.g., API keys, stream keys) in public repositories., Provide cybersecurity training for personnel managing public-facing media platforms., Adopt zero-trust principles for third-party integrations (e.g., social media APIs).Implement multi-factor authentication (MFA) for accessing media distribution portals., Conduct periodic red-team exercises to identify publicly exposed credentials., Enforce automated scanning for sensitive data (e.g., API keys, stream keys) in public repositories., Provide cybersecurity training for personnel managing public-facing media platforms., Adopt zero-trust principles for third-party integrations (e.g., social media APIs).
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are The incident highlights the vulnerabilities and potential risks to national security posed by cyber threats to key satellite infrastructure.Importance of modernizing authentication and anti-phishing security, real-time threat detection capabilitiesCritical need for securing IoT devices against botnet recruitment,Effectiveness of international law enforcement collaboration (Operation PowerOFF) in disrupting DDoS-for-hire services,Importance of proactive monitoring for anomalous traffic patterns (2–3 Tbps DDoS attacks)IoT device security vulnerabilities enable large-scale botnet formation.,DDoS-for-hire services pose significant threats to critical infrastructure and businesses.,Collaboration between law enforcement and private sector is critical for disrupting cybercrime operations.Effectiveness of Public-Private Partnerships in Botnet Takedowns,Role of Hyperscale Cloud Providers (e.g., AWS) in Cybercrime Disruption,Ongoing Threat of DDoS-for-Hire Services Despite High-Profile TakedownsPublic-facing portals must enforce strict access controls for sensitive credentials.,Stream keys and similar broadcast identifiers should be treated as highly confidential.,Regular audits of public websites for exposed credentials are critical, especially for high-profile organizations.,Sequential or predictable URL structures can exacerbate exposure risks.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Adopt modern ICAM systems, implement federated partnerships and The US military's Commercial Augmentation Space Reserve (CASR) initiative aims to improve resilience against such threats by partnering with the commercial space industry..
References
Where can I find more information about each incident ?
Incident : Security Vulnerability DEP306061125
Source: Federal News Network
URL: https://federalnewsnetwork.com/wp-content/uploads/2025/06/061025-OPTIVCLEARSHARK-BAASE-SEG-2.mp3
Date Accessed: 06-10-25
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Source: U.S. Attorney's Office, District of Alaska
Date Accessed: 2024-08-06
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Source: Department of Defense Office of Inspector General
Date Accessed: 2024-08-06
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Source: Operation PowerOFF (International Law Enforcement Initiative)
Date Accessed: 2024-12-01
Incident : DDoS Attack DEP445082225
Source: US Attorney's Office, District of Alaska
Date Accessed: 2024-08-19
Incident : DDoS Attack DEP445082225
Source: Cloudflare Blog - Record-Breaking 7.3 Tbps DDoS Attack
Incident : DDoS Attack DEP539082225
Source: U.S. Department of Justice
Incident : DDoS Attack DEP539082225
Source: AWS LinkedIn Post
Incident : DDoS Attack DEP539082225
Source: The Register (Article)
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Federal News NetworkUrl: https://federalnewsnetwork.com/wp-content/uploads/2025/06/061025-OPTIVCLEARSHARK-BAASE-SEG-2.mp3Date Accessed: 06-10-25, and Source: U.S. Attorney's Office, District of AlaskaDate Accessed: 2024-08-06, and Source: Department of Defense Office of Inspector GeneralDate Accessed: 2024-08-06, and Source: Operation PowerOFF (International Law Enforcement Initiative)Date Accessed: 2024-12-01, and Source: US Attorney's Office, District of AlaskaDate Accessed: 2024-08-19, and Source: Cloudflare Blog - Record-Breaking 7.3 Tbps DDoS Attack, and Source: U.S. Department of Justice, and Source: AWS LinkedIn Post, and Source: The Register (Article), and Source: The InterceptDate Accessed: 2024-09-02, and Source: The RegisterDate Accessed: 2024-09-02.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Investigation Status: Ongoing (Foltz charged; case part of broader Operation PowerOFF)
Incident : DDoS Attack DEP445082225
Investigation Status: Ongoing (Charges filed; botnet disrupted)
Incident : DDoS Attack DEP539082225
Investigation Status: Ongoing (Awaiting Trial)
Incident : Data Exposure DEP0792107090925
Investigation Status: Resolved (Vulnerability Remediated)
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Announcement By U.S. Attorney'S Office (District Of Alaska), Press Release Highlighting Operation Poweroff, Public Announcement By Us Attorney'S Office, Public Announcement By Doj, Aws Linkedin Post, Public Statement To *The Register* and Acknowledgment Of Fix.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : DDoS Attack DEP445082225
Stakeholder Advisories: Us Department Of Defense (Dod), Defense Industrial Base (Dib).
Customer Advisories: Victims advised to report attacks to law enforcement.Businesses urged to review DDoS protection measures.
Incident : DDoS Attack DEP539082225
Stakeholder Advisories: Warning To Potential Botnet Operators (Dcis Statement).
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Us Department Of Defense (Dod), Defense Industrial Base (Dib), Victims Advised To Report Attacks To Law Enforcement., Businesses Urged To Review Ddos Protection Measures., and Warning To Potential Botnet Operators (Dcis Statement).
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Phishing UNI141212522
Entry Point: Email
High Value Targets: Vendors of DoD
Data Sold on Dark Web: Vendors of DoD
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Entry Point: Exploited Iot Devices (Dvrs, Wifi Routers),
Backdoors Established: ['Persistent malware infections on 65,000–95,000 devices']
High Value Targets: U.S. Government Networks, Major Tech Companies, Social Media Platforms,
Data Sold on Dark Web: U.S. Government Networks, Major Tech Companies, Social Media Platforms,
Incident : DDoS Attack DEP445082225
Entry Point: Compromised Iot Devices (Dvrs, Wifi Routers),
High Value Targets: Us Government Networks, Tech Companies, Social Media Platforms,
Data Sold on Dark Web: Us Government Networks, Tech Companies, Social Media Platforms,
Incident : DDoS Attack DEP539082225
Entry Point: Compromised Iot Devices (Mirai Exploits),
High Value Targets: Us Government/Defense Networks,
Data Sold on Dark Web: Us Government/Defense Networks,
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Phishing UNI141212522
Root Causes: Human vulnerability to phishing attacks
Incident : Security Vulnerability DEP306061125
Root Causes: Critical vulnerabilities in federal systems
Corrective Actions: Implementation of modern ICAM systems
Incident : Distributed Denial of Service (DDoS) DEP1045082025
Root Causes: Proliferation Of Unsecured Iot Devices With Default Credentials, Lack Of Global Enforcement Against Ddos-For-Hire Markets, Sophistication Of Botnet Malware (Rapper Bot'S 2–3 Tbps Capacity),
Corrective Actions: Law Enforcement Takedown Of Botnet Infrastructure, Charges Against Operators To Deter Future Activity, Potential Regulatory Push For Iot Security Standards,
Incident : DDoS Attack DEP445082225
Root Causes: Exploitation Of Unsecured Iot Devices For Botnet Recruitment., Lack Of Adequate Ddos Protection In Targeted Organizations., Monetization Of Cybercrime Via Ddos-For-Hire Services.,
Corrective Actions: Disruption Of Rapper Bot Infrastructure Via Law Enforcement Action., Public Awareness Campaigns On Iot Security., Encouragement Of Threat Intelligence Sharing Among Industries.,
Incident : DDoS Attack DEP539082225
Root Causes: Proliferation Of Iot Devices With Weak Security, Demand For Ddos-For-Hire Services In Cybercrime Underground, Lack Of Global Coordination To Disrupt Botnet Infrastructure,
Corrective Actions: Takedown Of Rapperbot C2 Servers, Arrest Of Alleged Operator, International Collaboration (Operation Poweroff),
Incident : Data Exposure DEP0792107090925
Root Causes: Lack Of Access Controls On Dvids Portal (Publicly Browsable Without Authentication)., Improper Handling Of Sensitive Stream Keys (Treated As Non-Confidential)., Predictable Url Structure Enabling Enumeration Of Webcast Pages., Inadequate Oversight Of Third-Party Platform Integrations (Youtube, Facebook, X).,
Corrective Actions: Ceased Public Upload Of Stream Keys On Dvids., Generated And Deployed New Stream Keys Across All Platforms., Updated Internal Policies For Handling Broadcast Credentials., Likely Implemented Technical Controls To Prevent Future Exposures (E.G., Redaction, Access Restrictions).,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Real-time threat detection, International Law Enforcement (Operation Poweroff), , Industry Partners (E.G., Cloudflare), , Aws, Akamai, Cloudflare, Google, Digitalocean, Flashpoint, Paypal, Unit 221B, , Aws Threat Detection Tools, .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Implementation of modern ICAM systems, Law Enforcement Takedown Of Botnet Infrastructure, Charges Against Operators To Deter Future Activity, Potential Regulatory Push For Iot Security Standards, , Disruption Of Rapper Bot Infrastructure Via Law Enforcement Action., Public Awareness Campaigns On Iot Security., Encouragement Of Threat Intelligence Sharing Among Industries., , Takedown Of Rapperbot C2 Servers, Arrest Of Alleged Operator, International Collaboration (Operation Poweroff), , Ceased Public Upload Of Stream Keys On Dvids., Generated And Deployed New Stream Keys Across All Platforms., Updated Internal Policies For Handling Broadcast Credentials., Likely Implemented Technical Controls To Prevent Future Exposures (E.G., Redaction, Access Restrictions)., .
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an A California man and his teammates, Computer Hacker, Sean Caffrey, Name: Ethan FoltzLocation: Eugene, Oregon, USAAge: 22Nationality: AmericanMotivation: ['Financial gain (DDoS-for-hire)', 'Criminal enterprise'], Name: Ethan FoltzAffiliation: Rapper Bot BotnetLocation: Oregon, USAMotivation: ['Financial Gain', 'Cybercrime-as-a-Service']Status: Charged (Aiding and Abetting Computer Intrusions), Name: Ethan FoltzLocation: Eugene, Oregon and USAAge: 22Nationality: American.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2022.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-09-02.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on 2024-08-06.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was $23.5 million.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Login credentials, Usernames and email addresses of more than 800 users of a satellite communications system, as well as of about 30,000 satellite phones., ranks, usernames, email addresses, satellite phone access, , Stream Keys (Confidential Broadcast Identifiers) and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were satellitesbroadband services and U.S. government networkSocial media platformU.S. tech companiesVictims in 80+ countries and Government NetworksSocial Media PlatformsTech CompaniesIoT Devices (DVRs, WiFi Routers) and US Government NetworksDefense-Related ServicesSocial Media PlatformsChinese Gambling Outfits and DVIDS WebsiteDoD Social Media Accounts (YouTube, Facebook, X/Twitter).
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was international law enforcement (operation poweroff), , industry partners (e.g., cloudflare), , aws, akamai, cloudflare, google, digitalocean, flashpoint, paypal, unit 221b, .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Search warrant execution at Foltz's residenceSeizure of administrative control over Rapper Bot botnetDisruption of DDoS infrastructure, Botnet DisruptionArrest of Administrator, Seizure of Command-and-Control ServersDisruption of Malicious Infrastructure and Removal of Publicly Exposed Stream KeysDiscontinuation of Old Key-Sharing Practices.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Stream Keys (Confidential Broadcast Identifiers), satellite phone access, ranks, usernames, email addresses, Usernames and email addresses of more than 800 users of a satellite communications system, as well as of about 30,000 satellite phones. and Login credentials.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 31.6K.
Regulatory Compliance
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Federal criminal charges (1 count: aiding and abetting computer intrusions), , Criminal Charges (1 count of aiding and abetting computer intrusions), , Criminal Charges (Aiding and Abetting Computer Intrusions), .
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Sequential or predictable URL structures can exacerbate exposure risks.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enhance monitoring for botnet-related traffic patterns., Enforce automated scanning for sensitive data (e.g., API keys, stream keys) in public repositories., The US military's Commercial Augmentation Space Reserve (CASR) initiative aims to improve resilience against such threats by partnering with the commercial space industry., Implement default credential changes and regular patching for IoT devices, Strengthen IoT Device Security to Prevent Botnet Recruitment, Deploy DDoS mitigation solutions (e.g., scrubbing centers, rate limiting), Implement multi-factor authentication (MFA) for accessing media distribution portals., Adopt modern ICAM systems, implement federated partnerships, Implement DDoS mitigation strategies (e.g., rate limiting, traffic scrubbing)., Enhance DDoS Mitigation Capabilities for Critical Infrastructure, Strengthen IoT device security (e.g., default credential changes, firmware updates)., Conduct periodic red-team exercises to identify publicly exposed credentials., Report extortion attempts to law enforcement immediately., Public awareness campaigns on risks of DDoS-for-hire services, Provide cybersecurity training for personnel managing public-facing media platforms., Adopt zero-trust principles for third-party integrations (e.g., social media APIs)., Continue Cross-Sector Collaboration for Cyber Threat Disruption and Enhance cross-border cybercrime investigations and information sharing.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Federal News Network, U.S. Attorney's Office, District of Alaska, Cloudflare Blog - Record-Breaking 7.3 Tbps DDoS Attack, U.S. Department of Justice, The Intercept, The Register, Department of Defense Office of Inspector General, The Register (Article), US Attorney's Office, District of Alaska, Operation PowerOFF (International Law Enforcement Initiative) and AWS LinkedIn Post.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://federalnewsnetwork.com/wp-content/uploads/2025/06/061025-OPTIVCLEARSHARK-BAASE-SEG-2.mp3 .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (Foltz charged; case part of broader Operation PowerOFF).
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was US Department of Defense (DoD), Defense Industrial Base (DIB), Warning to Potential Botnet Operators (DCIS Statement), .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued was an Victims advised to report attacks to law enforcement.Businesses urged to review DDoS protection measures.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker was an Email.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Human vulnerability to phishing attacks, Critical vulnerabilities in federal systems, Proliferation of unsecured IoT devices with default credentialsLack of global enforcement against DDoS-for-hire marketsSophistication of botnet malware (Rapper Bot's 2–3 Tbps capacity), Exploitation of unsecured IoT devices for botnet recruitment.Lack of adequate DDoS protection in targeted organizations.Monetization of cybercrime via DDoS-for-hire services., Proliferation of IoT Devices with Weak SecurityDemand for DDoS-for-Hire Services in Cybercrime UndergroundLack of Global Coordination to Disrupt Botnet Infrastructure, Lack of access controls on DVIDS portal (publicly browsable without authentication).Improper handling of sensitive stream keys (treated as non-confidential).Predictable URL structure enabling enumeration of webcast pages.Inadequate oversight of third-party platform integrations (YouTube, Facebook, X)..
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Implementation of modern ICAM systems, Law enforcement takedown of botnet infrastructureCharges against operators to deter future activityPotential regulatory push for IoT security standards, Disruption of Rapper Bot infrastructure via law enforcement action.Public awareness campaigns on IoT security.Encouragement of threat intelligence sharing among industries., Takedown of RapperBot C2 ServersArrest of Alleged OperatorInternational Collaboration (Operation PowerOFF), Ceased public upload of stream keys on DVIDS.Generated and deployed new stream keys across all platforms.Updated internal policies for handling broadcast credentials.Likely implemented technical controls to prevent future exposures (e.g., redaction, access restrictions)..
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=deptofwar' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
