Saturday, April 5, 2025
HomeCyber AttackRansom DDoS Attack that Reached a Rate of 2.5 Million Requests per...

Ransom DDoS Attack that Reached a Rate of 2.5 Million Requests per Second

Published on

SIEM as a Service

Follow Us on Google News

Imperva security firm recently claimed that it has managed to foil a massive ransom distributed denial-of-service (DDoS) cyberattack that peaked at 2.5 million requests per second recently (on a single server), keeping some unnamed site up and running and uncrashed by reducing the RPS by 99%.

Ransom DDoS attacks have been around for a long time in one form or another, but it appears as though the attacks are evolving and becoming more creative with time.

In short, in this form, the ransom message can get embedded directly into the URL itself without going through inputting it manually because it is written into the code.

Here’s what the cybersecurity analyst at Imperva, Nelli Klepfish stated:-

“While ransom DDoS attacks are not new, they appear to be evolving and becoming more interesting with time and with each new phase. For example, we’ve seen instances where the ransom note is included in the attack itself embedded into a URL request.”

Top Sources of the Attacks

While apart from this, the top sources of this massive attack came from the following countries:-

  • Indonesia
  • The U.S.
  • China
  • Brazil
  • India
  • Colombia
  • Russia
  • Thailand
  • Mexico
  • Argentina

Operators

Let’s get technical for a minute, DDoS is the shortening of Distributed Denial-of-Service attacks. In short, it’s an army of connected devices being used to overload or “flood” a website with so much data that it can no longer function properly and becomes unavailable to legitimate users – hence why this is called a DoS attack.

Multiple ransom notes were received by the affected company in which the threat actors demanded that the affected companies should make a bitcoin payment to remain online and prevent the major loss of hundreds of millions.

The hackers calling themselves REvil, the same notorious RANSOMWARE-AS-A-SERVICE group that was dealt a significant setback after central figures were arrested in Russia by law enforcement earlier this January 2022.

Targets and Technique

However, in this event, the operators have used the Mēris botnet to execute this massive DDoS attack with 2.5 million RPS that lasted for approximately 10 minutes.

Here, the Mēris botnet abuse the recently patched security flaw in Mikrotik routers (CVE-2018-14847) to strike its targets, and the technique used by the attackers is a new technique that is known as:-

  • TCP Middlebox Reflection

The cybersecurity experts Klepfish at Imperva security firm stated:-

“The types of sites the threat actors are after appear to be business sites focusing on sales and communications. Targets tend to be U.S.- or Europe-based with the one thing they all have in common being that they are all exchange-listed companies and the threat actors use this to their advantage by referring to the potential damage a DDoS attack could do to the company stock price.”

In short, primarily the attackers have targeted the business sales and communications sites that are based in the United States and Europe.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Ivanti Fully Patched Connect Secure RCE Vulnerability That Actively Exploited in the Wild

Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti...

Beware! Weaponized Job Recruitment Emails Spreading BeaverTail and Tropidoor Malware

A concerning malware campaign was disclosed by the AhnLab Security Intelligence Center (ASEC), revealing...

EncryptHub Ransomware Uncovered Through ChatGPT Use and OPSEC Failures

EncryptHub, a rapidly evolving cybercriminal entity, has come under intense scrutiny following revelations of...

PoisonSeed Targets CRM and Bulk Email Providers in New Supply Chain Phishing Attack

A sophisticated phishing campaign, dubbed "PoisonSeed," has been identified targeting customer relationship management (CRM)...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Hackers Use URL Shorteners and QR Codes in Tax-Themed Phishing Attacks

As the United States approaches Tax Day on April 15, cybersecurity experts have uncovered...

Hackers Exploit Fast Flux to Evade Detection and Obscure Malicious Servers

Cybersecurity agencies worldwide have issued a joint advisory warning against the growing threat posed...

DarkCloud Stealer Uses Weaponized .TAR Archives to Target Organizations and Steal Passwords

A recent cyberattack campaign leveraging the DarkCloud stealer has been identified, targeting Spanish companies...