Friday, March 29, 2024

Ransom DDoS Attack that Reached a Rate of 2.5 Million Requests per Second

Imperva security firm recently claimed that it has managed to foil a massive ransom distributed denial-of-service (DDoS) cyberattack that peaked at 2.5 million requests per second recently (on a single server), keeping some unnamed site up and running and uncrashed by reducing the RPS by 99%.

Ransom DDoS attacks have been around for a long time in one form or another, but it appears as though the attacks are evolving and becoming more creative with time.

In short, in this form, the ransom message can get embedded directly into the URL itself without going through inputting it manually because it is written into the code.

Here’s what the cybersecurity analyst at Imperva, Nelli Klepfish stated:-

“While ransom DDoS attacks are not new, they appear to be evolving and becoming more interesting with time and with each new phase. For example, we’ve seen instances where the ransom note is included in the attack itself embedded into a URL request.”

Top Sources of the Attacks

While apart from this, the top sources of this massive attack came from the following countries:-

  • Indonesia
  • The U.S.
  • China
  • Brazil
  • India
  • Colombia
  • Russia
  • Thailand
  • Mexico
  • Argentina

Operators

Let’s get technical for a minute, DDoS is the shortening of Distributed Denial-of-Service attacks. In short, it’s an army of connected devices being used to overload or “flood” a website with so much data that it can no longer function properly and becomes unavailable to legitimate users – hence why this is called a DoS attack.

Multiple ransom notes were received by the affected company in which the threat actors demanded that the affected companies should make a bitcoin payment to remain online and prevent the major loss of hundreds of millions.

The hackers calling themselves REvil, the same notorious RANSOMWARE-AS-A-SERVICE group that was dealt a significant setback after central figures were arrested in Russia by law enforcement earlier this January 2022.

Targets and Technique

However, in this event, the operators have used the MÄ“ris botnet to execute this massive DDoS attack with 2.5 million RPS that lasted for approximately 10 minutes.

Here, the MÄ“ris botnet abuse the recently patched security flaw in Mikrotik routers (CVE-2018-14847) to strike its targets, and the technique used by the attackers is a new technique that is known as:-

  • TCP Middlebox Reflection

The cybersecurity experts Klepfish at Imperva security firm stated:-

“The types of sites the threat actors are after appear to be business sites focusing on sales and communications. Targets tend to be U.S.- or Europe-based with the one thing they all have in common being that they are all exchange-listed companies and the threat actors use this to their advantage by referring to the potential damage a DDoS attack could do to the company stock price.”

In short, primarily the attackers have targeted the business sales and communications sites that are based in the United States and Europe.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles