Polish authorities have dismantled a teenage cybercrime gang that was distributing and selling DDoS attack tools online. This operation is part of a broader trend of law enforcement targeting “booter” and “stresser” services often operated by minors. 

1. Poland: Teen DDoS Distribution Ring (March 2026)

Poland’s Central Bureau for Combating Cybercrime (CBZC) identified seven minors—aged 12 to 16—who were allegedly running a profit-driven scheme selling DDoS kits.

• The Investigation: Triggered in 2025, the case began when a 14-year-old leader from the Masovian Voivodeship was identified as an administrator.
• Targets: Tools sold by the group were used to attack auction sites, hosting services, and accommodation booking portals.
• Seizures: Police raided homes across four regions, seizing computers, hard drives, and handwritten ledgers detailing their operations. The suspects have been referred to family courts. 

2. Global Takedowns of DDoS-for-Hire Services

This latest bust follows several major international efforts to shut down the infrastructure used by young hackers: 

• Operation PowerOFF (Ongoing): This global initiative led by the FBI, NCA, and Europol continues to target stresser and booter websites. In May 2025, law enforcement seized nine major DDoS-for-hire domains that allowed users to launch massive attacks for a small fee.
• DigitalStress Infiltration: In mid-2024, the UK’s National Crime Agency (NCA) infiltrated DigitalStress, a marketplace responsible for tens of thousands of weekly attacks. One of its suspected controllers was arrested in Northern Ireland.
• Dstat.cc Takedown: In late 2024, German police arrested two individuals associated with Dstat.cc, a platform that provided reviews and contact info for booter services, essentially acting as a directory for DDoS tools. 

3. Emerging “Scattered Spider” Activity

Law enforcement is also focusing on younger, English-speaking hackers associated with collectives like Scattered Spider. These groups often start with DDoS and “booting” in gaming communities before escalating to high-profile ransomware attacks on retailers and casinos.