Thursday, April 3, 2025
HomeCyber AttackRansom DDoS Attack that Reached a Rate of 2.5 Million Requests per...

Ransom DDoS Attack that Reached a Rate of 2.5 Million Requests per Second

Published on

SIEM as a Service

Follow Us on Google News

Imperva security firm recently claimed that it has managed to foil a massive ransom distributed denial-of-service (DDoS) cyberattack that peaked at 2.5 million requests per second recently (on a single server), keeping some unnamed site up and running and uncrashed by reducing the RPS by 99%.

Ransom DDoS attacks have been around for a long time in one form or another, but it appears as though the attacks are evolving and becoming more creative with time.

In short, in this form, the ransom message can get embedded directly into the URL itself without going through inputting it manually because it is written into the code.

Here’s what the cybersecurity analyst at Imperva, Nelli Klepfish stated:-

“While ransom DDoS attacks are not new, they appear to be evolving and becoming more interesting with time and with each new phase. For example, we’ve seen instances where the ransom note is included in the attack itself embedded into a URL request.”

Top Sources of the Attacks

While apart from this, the top sources of this massive attack came from the following countries:-

  • Indonesia
  • The U.S.
  • China
  • Brazil
  • India
  • Colombia
  • Russia
  • Thailand
  • Mexico
  • Argentina

Operators

Let’s get technical for a minute, DDoS is the shortening of Distributed Denial-of-Service attacks. In short, it’s an army of connected devices being used to overload or “flood” a website with so much data that it can no longer function properly and becomes unavailable to legitimate users – hence why this is called a DoS attack.

Multiple ransom notes were received by the affected company in which the threat actors demanded that the affected companies should make a bitcoin payment to remain online and prevent the major loss of hundreds of millions.

The hackers calling themselves REvil, the same notorious RANSOMWARE-AS-A-SERVICE group that was dealt a significant setback after central figures were arrested in Russia by law enforcement earlier this January 2022.

Targets and Technique

However, in this event, the operators have used the Mēris botnet to execute this massive DDoS attack with 2.5 million RPS that lasted for approximately 10 minutes.

Here, the Mēris botnet abuse the recently patched security flaw in Mikrotik routers (CVE-2018-14847) to strike its targets, and the technique used by the attackers is a new technique that is known as:-

  • TCP Middlebox Reflection

The cybersecurity experts Klepfish at Imperva security firm stated:-

“The types of sites the threat actors are after appear to be business sites focusing on sales and communications. Targets tend to be U.S.- or Europe-based with the one thing they all have in common being that they are all exchange-listed companies and the threat actors use this to their advantage by referring to the potential damage a DDoS attack could do to the company stock price.”

In short, primarily the attackers have targeted the business sales and communications sites that are based in the United States and Europe.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Hackers Selling SnowDog RAT Malware With Remote Control Capabilities Online

A sophisticated remote access trojan (RAT) dubbed SnowDog has surfaced on underground cybercrime forums, prompting alarms...

Authorities Shut Down Kidflix Child Abuse Platform in Major Takedown

In one of the most significant operations against child sexual exploitation in recent history,...

Massive GitHub Leak: 39M API Keys & Credentials Exposed – How to Strengthen Security

Over 39 million API keys, credentials, and other sensitive secrets were exposed on GitHub...

GoResolver: A Powerful New Tool for Analyzing Golang Malware

Analyzing malware has become increasingly challenging, especially with the growing popularity of programming languages...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Hackers Exploit Cloudflare for Advanced Phishing Attacks

A sophisticated phishing campaign orchestrated by a Russian-speaking threat actor has been uncovered, revealing...

Over 1,500 PostgreSQL Servers Hit by Fileless Malware Attack

A sophisticated malware campaign has compromised over 1,500 PostgreSQL servers, leveraging fileless techniques to...

QR Code Phishing (Quishing) Attack Your Smartphones To Steal Microsoft Accounts Credentials

Cybersecurity researchers have identified a growing trend in phishing attacks leveraging QR codes, a...