Tuesday, July 16, 2024

Ransom DDoS Attack that Reached a Rate of 2.5 Million Requests per Second

Imperva security firm recently claimed that it has managed to foil a massive ransom distributed denial-of-service (DDoS) cyberattack that peaked at 2.5 million requests per second recently (on a single server), keeping some unnamed site up and running and uncrashed by reducing the RPS by 99%.

Ransom DDoS attacks have been around for a long time in one form or another, but it appears as though the attacks are evolving and becoming more creative with time.

In short, in this form, the ransom message can get embedded directly into the URL itself without going through inputting it manually because it is written into the code.

Here’s what the cybersecurity analyst at Imperva, Nelli Klepfish stated:-

“While ransom DDoS attacks are not new, they appear to be evolving and becoming more interesting with time and with each new phase. For example, we’ve seen instances where the ransom note is included in the attack itself embedded into a URL request.”

Top Sources of the Attacks

While apart from this, the top sources of this massive attack came from the following countries:-

  • Indonesia
  • The U.S.
  • China
  • Brazil
  • India
  • Colombia
  • Russia
  • Thailand
  • Mexico
  • Argentina


Let’s get technical for a minute, DDoS is the shortening of Distributed Denial-of-Service attacks. In short, it’s an army of connected devices being used to overload or “flood” a website with so much data that it can no longer function properly and becomes unavailable to legitimate users – hence why this is called a DoS attack.

Multiple ransom notes were received by the affected company in which the threat actors demanded that the affected companies should make a bitcoin payment to remain online and prevent the major loss of hundreds of millions.

The hackers calling themselves REvil, the same notorious RANSOMWARE-AS-A-SERVICE group that was dealt a significant setback after central figures were arrested in Russia by law enforcement earlier this January 2022.

Targets and Technique

However, in this event, the operators have used the Mēris botnet to execute this massive DDoS attack with 2.5 million RPS that lasted for approximately 10 minutes.

Here, the Mēris botnet abuse the recently patched security flaw in Mikrotik routers (CVE-2018-14847) to strike its targets, and the technique used by the attackers is a new technique that is known as:-

  • TCP Middlebox Reflection

The cybersecurity experts Klepfish at Imperva security firm stated:-

“The types of sites the threat actors are after appear to be business sites focusing on sales and communications. Targets tend to be U.S.- or Europe-based with the one thing they all have in common being that they are all exchange-listed companies and the threat actors use this to their advantage by referring to the potential damage a DDoS attack could do to the company stock price.”

In short, primarily the attackers have targeted the business sales and communications sites that are based in the United States and Europe.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

HardBit Ransomware Using Passphrase Protection To Evade Detection

In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware...

New Poco RAT Weaponizing 7zip Files Using Google Drive

The hackers weaponize 7zip files to pass through security measures and deliver malware effectively.These...

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails...

Hacktivist Groups Preparing for DDoS Attacks Targeting Paris Olympics

Cyble Research & Intelligence Labs (CRIL) researchers have identified a cyber threat targeting the...

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles