Score:   1
Docket Number:   D-AK  3:18-cr-00154
Case Name:   USA v. Bukoski
  Press Releases:
Anchorage, Alaska – U.S. Attorney Bryan Schroder announced that David Bukoski, 24, of Hanover Township, Pennsylvania, was recently sentenced for operating a long-running Denial of Service (DoS) for-hire service, known as Quantum Stress, which allowed paying users to conduct wide-ranging attacks on individual and corporate victim domains and networks, preventing them from being able to access the internet.  In August 2019, Bukoski pleaded guilty as charged for aiding and abetting computer intrusions, and he was sentenced for his conduct on Feb. 4, 2020.

Due to the large number of potential victims in this case, Chief U.S. District Judge Timothy M. Burgess issued an order directing the government to employ alternative victim notification procedures so that any member of the community at large who believes they may be a crime victim is made aware of their potential rights.

The government is asking that members of the community who believe they may be a victim of Bukoski’s criminal activities, to please contact (907) 271-3041 to reach the Victim-Witness Unit at the U.S. Attorney’s Office, District of Alaska. 

The victim-witness program of the U.S. Attorney’s Office, District of Alaska, provides information, services, and support to individuals during federal prosecutions.  Case updates will be provided on the U.S. Attorney’s Office, District of Alaska website at https://www.justice.gov/usao-ak/case-updates. A restitution hearing in this case is scheduled for May 5, 2020, at 10:30 A.M. in Anchorage.  

According to public court filings, Bukoski became the subject of a federal investigation when FBI agents began investigating individuals in the United States and abroad operating what were suspected to be the longest running and most prevalent DoS-for-hire services.  These websites, which offered what are often called “booter” or “stresser” services, are a mechanism by which criminals can manipulate (in most cases stolen) bandwidth and architecture for the purpose of damaging the targeted victim’s access to the internet by flooding them with internet traffic with the intent of causing damage or financial loss.  The FBI’s investigation ultimately identified Bukoski as one of the individuals operating and profiting from one of these booter services under the domain “quantumstress.net.”

The investigation revealed that Bukoski made a number of different subscription plans available to his approximately 70-80,000 subscribers between 2011 and 2018, all of which entailed payment by the subscriber in exchange for some period of access to attack infrastructure controlled by Bukoski. It was further revealed that Bukoski’s booter service had been used both by individuals outside of Alaska to attack Alaskan victims, as well as individuals in Alaska to attack others outside.

This case was the product of an investigation conducted by the FBI’s Anchorage Field Office and the FBI’s Cyber Initiative and Resource Fusion Unit (CIRFU).  The case against Bukoski was prosecuted by Assistant U.S. Attorney Adam Alexander of the U.S. Attorney’s Office for the District of Alaska.

Anchorage, Alaska – U.S. Attorney Bryan Schroder announced today the seizure of an internet domain associated with DDoS-for-hire services, as well as criminal charges against a Pennsylvania man who facilitated the computer attack platform.  This case was brought as part of an FBI investigation that led to the seizure of 15 websites, resulting in criminal charges filed from the U.S. Attorney’s Offices for the District of Alaska and the Central District of California. 

The sites, which offered what are often called “booter” or “stresser” services, allowed paying users to launch powerful distributed denial-of-service, or DDoS, attacks that flood targeted computers with information and prevent them from being able to access the internet.  Booter services such as named in this action allegedly cause attacks on a wide array of victims in the United States and abroad, including financial institutions, universities, internet service providers, government systems, and various gaming platforms. The action against the DDoS services comes the week before the Christmas holiday, a period historically plagued by prolific DDoS attacks in the gaming world.

The U.S. Attorney’s Office for the District of Alaska charged David Bukoski, 23, of Hanover Township, Pennsylvania, with aiding and abetting computer intrusions.  The charging documents allege that Bukoski operated Quantum Stresser, one of the longest-running DDoS services in operation.  As of Nov. 29, Quantum had over 80,000 customer subscriptions dating back to its launch in 2012.  In 2018 alone, Quantum was used to launch over 50,000 actual or attempted DDoS attacks targeting victims worldwide, including victims in Alaska and California.  On Dec. 19, pursuant to seizure warrants issued by the U.S. District Court for the Central District of California, the FBI seized the domains of 15 booter services, one of them being quantumstress.net, the service operated by Bukoski.

“The internet has become the nerve system of modern life, including modern business and government operations,” said U.S. Attorney Schroder.  “Against that backdrop, it is essential for law enforcement officers and prosecutors to act swiftly and decisively when criminals attack any part of that system, especially the end users.”

“FBI Anchorage’s Cyber squad worked closely with the FBI’s Los Angeles, Chicago, and Philadelphia Field Offices to address the severe threat posed by DDoS-for-hire in advance of the holiday season,” said Jeffery Peterson, the Special Agent in Charge of FBI’s Anchorage Field Office.  “The FBI could not have conducted this successful investigative effort without the cooperation of our international law enforcement and private industry partners.  Criminal enterprises and individual actors routinely use DDoS to disrupt networks and damage internet-based services, often resulting in substantial financial losses to companies and individuals. The FBI will continue to aggressively pursue all crimes in cyberspace and strengthen America's cybersecurity.”

Over the past five years, booter and stresser services have grown as an increasingly prevalent class of DDoS attack tools.  These types of DDoS attacks are so named because they result in the “booting” or dropping of the victim-targeted website from the internet.  Booter-based DDoS attack tools offer a low barrier to entry for users looking to engage in cyber criminal activity, representing an effective advance in internet attack technology.  For additional information on booter and stresser services and the harm that they cause, please visit: https://www.ic3.gov/media/2017/171017-2.aspx.

The case against Bukoski is being prosecuted by Assistant U.S. Attorney Adam Alexander of the District of Alaska and Trial Attorney C. Alden Pelker of the Computer Crime and Intellectual Property Section (CCIPS) of the Criminal Division. 

The case announced today is being investigated by the FBI’s Anchorage Field Office and the FBI’s Cyber Initiative and Resource Fusion Unit (CIRFU).  Additional assistance was provided by the FBI’s Chicago, Los Angeles, Memphis, and Philadelphia Field Offices and the Scranton, Pennsylvania Resident Agency; the Major Cyber Crimes Unit, Global Operations and Targeting Unit, and Money Laundering Intelligence Unit of FBI Headquarters; Defense Criminal Investigative Service; and the U.S. Attorney’s Offices for the Eastern District of Pennsylvania, Middle District of Pennsylvania, Western District of Tennessee and the Northern District of Illinois.  The United Kingdom’s National Crime Agency, the Dutch National Police – National High Tech Crime Unit, and the National Cyber-Forensics & Training Alliance made invaluable contributions.  Akamai, Bell Aliant, Cloudflare, Entertainment Software Association, Flashpoint, Google, Oath Inc., Oracle, Palo Alto Networks Unit 42, PayPal, Riot Games, ShadowDragon, SpyCloud, University of Cambridge and other valued private sector partners provided additional assistance.

The charges in the indictment are merely allegations, and the defendant is presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Docket (0 Docs):   https://docs.google.com/spreadsheets/d/1pjbQglDCE9GeGXuLB-3yfu4EhH_6ToFRQUNreveTSpk
  Last Updated: 2023-10-27 15:23:23 UTC
Description: The fiscal year of the data file obtained from the AOUSC
Format: YYYY

Description: The code of the federal judicial circuit where the case was located
Format: A2

Description: The code of the federal judicial district where the case was located
Format: A2

Description: The code of the district office where the case was located
Format: A2

Description: Docket number assigned by the district to the case
Format: A7

Description: A unique number assigned to each defendant in a case which cannot be modified by the court
Format: A3

Description: A unique number assigned to each defendant in a case which can be modified by the court
Format: A3

Description: A sequential number indicating whether a case is an original proceeding or a reopen
Format: N5

Description: Case type associated with the current defendant record
Format: A2

Description: A concatenation of district, office, docket number, case type, defendant number, and reopen sequence number
Format: A18

Description: A concatenation of district, office, docket number, case type, and reopen sequence number
Format: A15

Description: The status of the defendant as assigned by the AOUSC
Format: A2

Description: A code indicating the fugitive status of a defendant
Format: A1

Description: The date upon which a defendant became a fugitive
Format: YYYYMMDD

Description: The date upon which a fugitive defendant was taken into custody
Format: YYYYMMDD

Description: The date when a case was first docketed in the district court
Format: YYYYMMDD

Description: The date upon which proceedings in a case commenced on charges pending in the district court where the defendant appeared, or the date of the defendant’s felony-waiver of indictment
Format: YYYYMMDD

Description: A code used to identify the nature of the proceeding
Format: N2

Description: The date when a defendant first appeared before a judicial officer in the district court where a charge was pending
Format: YYYYMMDD

Description: A code indicating the event by which a defendant appeared before a judicial officer in the district court where a charge was pending
Format: A2

Description: A code indicating the type of legal counsel assigned to a defendant
Format: N2

Description: The title and section of the U.S. Code applicable to the offense committed which carried the highest severity
Format: A20

Description: A code indicating the level of offense associated with FTITLE1
Format: N2

Description: The four digit AO offense code associated with FTITLE1
Format: A4

Description: The four digit D2 offense code associated with FTITLE1
Format: A4

Description: A code indicating the severity associated with FTITLE1
Format: A3

Description: The FIPS code used to indicate the county or parish where an offense was committed
Format: A5

Description: The date of the last action taken on the record
Format: YYYYMMDD

Description: The date upon which judicial proceedings before the court concluded
Format: YYYYMMDD

Description: The date upon which the final sentence is recorded on the docket
Format: YYYYMMDD

Description: The date upon which the case was closed
Format: YYYYMMDD

Description: The total fine imposed at sentencing for all offenses of which the defendant was convicted and a fine was imposed
Format: N8

Description: A count of defendants filed including inter-district transfers
Format: N1

Description: A count of defendants filed excluding inter-district transfers
Format: N1

Description: A count of original proceedings commenced
Format: N1

Description: A count of defendants filed whose proceedings commenced by reopen, remand, appeal, or retrial
Format: N1

Description: A count of defendants terminated including interdistrict transfers
Format: N1

Description: A count of defendants terminated excluding interdistrict transfers
Format: N1

Description: A count of original proceedings terminated
Format: N1

Description: A count of defendants terminated whose proceedings commenced by reopen, remand, appeal, or retrial
Format: N1

Description: A count of defendants pending as of the last day of the period including long term fugitives
Format: N1

Description: A count of defendants pending as of the last day of the period excluding long term fugitives
Format: N1

Description: The source from which the data were loaded into the AOUSC’s NewSTATS database
Format: A10

Description: A sequential number indicating the iteration of the defendant record
Format: N2

Description: The date the record was loaded into the AOUSC’s NewSTATS database
Format: YYYYMMDD

Description: Statistical year ID label on data file obtained from the AOUSC which represents termination year
Format: YYYY

Data imported from FJC Integrated Database
F U C K I N G P E D O S R E E E E E E E E E E E E E E E E E E E E