Matthew Gatrel, 33, of St. Charles, Illinois, received his sentence after he was found guilty after a nine-day trial in September last year. In the trial, a federal jury found Gatrel guilty of one count of conspiracy to commit unauthorized impairment of a protected computer, one count of conspiracy to commit wire fraud, and one count of unauthorized impairment of a protected computer.
Gatrel owned and operated two DDoS facilitation websites: DownThem.org and AmpNode.com.
“Gatrel ran a criminal enterprise designed around launching hundreds of thousands of cyber-attacks on behalf of hundreds of customers,” prosecutors wrote in a sentencing memorandum. “He also provided infrastructure and resources for other cybercriminals to run their own businesses launching these same kinds of attacks. These attacks victimized wide swaths of American society and compromised computers around the world.”
Records from the DownThem service revealed more than 2,000 registered users and more than 200,000 launched attacks, including attacks on homes, schools, universities, municipal and local government websites, and financial institutions worldwide. Many AmpNode customers were themselves operating for-profit DDoS services.
Gatrel offered expert advice to customers of both services, providing guidance on the best attack methods to “down” different types of computers, specific hosting providers, or to bypass DDoS protection services. Gatrel himself often used the DownThem service to demonstrate to prospective customers the power and effectiveness of products, by attacking the customer’s intended victim and providing proof, via screenshot, that he had severed the victim’s Internet connection.
Gatrel’s DownThem customers could select from a variety of different paid “subscription plans.”
The subscription plans varied in cost and offered escalating attack capability, allowing customers to select different attack durations and relative attack power, as well as the ability to launch several simultaneous, or “concurrent” attacks. Once a customer entered the information necessary to launch an attack on their victim, Gatrel’s system was set up to use one or more of his own dedicated attack servers to unlawfully appropriate the resources of hundreds or thousands of other servers connected to the Internet in “reflected amplification attacks.”
Co-defendant Juan Martinez, 29, of Pasadena, California, pleaded guilty in August 2021 to one count of unauthorized impairment of a protected computer and was sentenced to five years’ probation. Martinez was one of Gatrel’s customers and became a co-administrator of the site in 2018.