Friday, May 24, 2024

Project DDoSia – Russian Hackers Planning a Massive DDoS Attack

Hackers launch large-scale DDoS attacks to disrupt and make online services inaccessible, driven by motives like revenge or protest, flooding targets with massive amounts of traffic to disable websites.

Recently, the cybersecurity researchers at Sekoia identified that the Russian hacker group “NoName057(16)” has been actively planning to conduct massive DDoS attacks.

Since the Ukraine conflict began, the nationalist hacktivist groups, notably the “NoName057(16),” have risen and are found to be launching Project DDoSia. 

They target pro-Ukraine entities, mostly NATO members.

Sekoia actively tracks its C2 infrastructure, which is automated for target collection and real-time monitoring.

Integrate ANY.RUN in your company for Effective Malware Analysis

Are you from SOC and DFIR teams? – Join With 400,000 independent Researchers

Malware analysis can be fast and simple. Just let us show you the way to:

  • Interact with malware safely
  • Set up virtual machine in Linux and all Windows OS versions
  • Work in a team
  • Get detailed reports with maximum data
  • If you want to test all these features now with completely free access to the sandbox: ..

Project DDoSia: Massive DDoS Attack

The Project DDoSia’s Telegram channel recently, on 11 November 2023, dropped a surprise update by expanding processor support to 32-bit and adding FreeBSD compatibility. 

While the prior versions had AMD64, ARM, and ARM64 covered. Main ZIP has two folders (d_eu, d_ru) for location-based execution.

Executing shows a warning, suggesting VPN for users in Russia.

Warning message (Source – Sekoia)

No VPN mandate in Russia hints at the NoName057(16) group’s possible ties with the state despite no public acknowledgment. 

The latest version alters encryption for user-C2 server data exchange. The operating diagram for DDoSia project initiation is provided as a reminder.

Attack Chain (Source – Sekoia)

The latest update adds encryption for data in HTTP POST requests which is a new feature absent in previous versions.

C value, a GUID identifying the user’s machine, is encrypted and extracted from \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid on Windows. 

The U value is from the client_id.txt file via DDoSia’s Telegram Bot. Besides this, the JSON table “inf” tracks seven elements under Windows, likely for statistical analysis, enhancing transmission sophistication.

The latest software version improved data transmission, but DDoSia admins changed the C2 servers frequently in 2024, facing stability challenges, read the Sekoia report.

NoName057(16) updated the Telegram channel with each server config change which requires users to download and install for continued attacks. 

Besides this, DDoSia lacks automated IP address change despite frequent C2 changes. Infrastructure interruptions didn’t hamper NoName057(16) group’s daily attacks.

DDoSia likely uses its servers to actively participate in attacks.

Top Countries Targeted

Here below we have mentioned all the top targeted countries:-

  • Ukraine
  • Finland
  • Italy
  • Spain
  • Germany
  • Lithuania
  • France
  • Poland
  • Switzerland
  • Romania
  • Netherlands
  • Estonia
  • Sweden
  • Latvia
  • Greece
  • United Kingdom
  • Czech Republic
  • Belgium

Top Sectors Targeted

Here below, we have mentioned all the sectors that are targeted most:-

  • Government
  • Banking
  • Transportation
  • Technology
  • Energy
  • Defence

The DDoSia’s Telegram project nears 20,000 users, while NoName057(16) channels surpass 60,000, doubling since 2023. 

The growth represents a politically and economically motivated community.

NoName057(16) collaborates with hacktivist groups, forming alliances against Italian infrastructures. 

Despite DDoSia’s ever-changing infrastructure, it consistently claims attacks.

Not only that even, it also provides daily software updates and a 2024 version with enhanced encryption.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles