Ransom DDoS Attack that Reached a Rate of 2.5 Million Requests per Second

Imperva security firm recently claimed that it has managed to foil a massive ransom distributed denial-of-service (DDoS) cyberattack that peaked at 2.5 million requests per second recently (on a single server), keeping some unnamed site up and running and uncrashed by reducing the RPS by 99%.

Ransom DDoS attacks have been around for a long time in one form or another, but it appears as though the attacks are evolving and becoming more creative with time.

In short, in this form, the ransom message can get embedded directly into the URL itself without going through inputting it manually because it is written into the code.

Here’s what the cybersecurity analyst at Imperva, Nelli Klepfish stated:-

“While ransom DDoS attacks are not new, they appear to be evolving and becoming more interesting with time and with each new phase. For example, we’ve seen instances where the ransom note is included in the attack itself embedded into a URL request.”

Top Sources of the Attacks

While apart from this, the top sources of this massive attack came from the following countries:-

• Indonesia
• The U.S.
• China
• Brazil
• India
• Colombia
• Russia
• Thailand
• Mexico
• Argentina

Operators

Let’s get technical for a minute, DDoS is the shortening of Distributed Denial-of-Service attacks. In short, it’s an army of connected devices being used to overload or “flood” a website with so much data that it can no longer function properly and becomes unavailable to legitimate users – hence why this is called a DoS attack.

Multiple ransom notes were received by the affected company in which the threat actors demanded that the affected companies should make a bitcoin payment to remain online and prevent the major loss of hundreds of millions.

The hackers calling themselves REvil, the same notorious RANSOMWARE-AS-A-SERVICE group that was dealt a significant setback after central figures were arrested in Russia by law enforcement earlier this January 2022.

Targets and Technique

However, in this event, the operators have used the Mēris botnet to execute this massive DDoS attack with 2.5 million RPS that lasted for approximately 10 minutes.

Here, the Mēris botnet abuse the recently patched security flaw in Mikrotik routers (CVE-2018-14847) to strike its targets, and the technique used by the attackers is a new technique that is known as:-

• TCP Middlebox Reflection

The cybersecurity experts Klepfish at Imperva security firm stated:-

“The types of sites the threat actors are after appear to be business sites focusing on sales and communications. Targets tend to be U.S.- or Europe-based with the one thing they all have in common being that they are all exchange-listed companies and the threat actors use this to their advantage by referring to the potential damage a DDoS attack could do to the company stock price.”

In short, primarily the attackers have targeted the business sales and communications sites that are based in the United States and Europe.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.