TechCentralTechCentral
    Facebook Twitter YouTube LinkedIn
    Facebook Twitter LinkedIn YouTube
    TechCentral TechCentral
    NEWSLETTER
    • News

      Curro pilots artificial intelligence for learning in its schools

      20 May 2022

      Dark weekend lies ahead thanks to you know who

      20 May 2022

      CSIR develops app to help kids learn to read

      20 May 2022

      Prosus to sell Russia’s Avito

      20 May 2022

      Shock as Mustek CEO David Kan dies

      19 May 2022
    • World

      Chip giant ASML places big bets on a tiny future

      20 May 2022

      Musk moves to soothe investor fears over Tesla

      20 May 2022

      Apple is almost ready to show off its mixed-reality headset

      20 May 2022

      TikTok plans big push into gaming

      19 May 2022

      Musk says he will vote Republican, calls ESG a ‘scam’

      19 May 2022
    • In-depth

      Elon Musk is becoming like Henry Ford – and that’s not a good thing

      17 May 2022

      Stablecoins wend wobbly way into the unknown

      17 May 2022

      The standard model of particle physics may be broken

      11 May 2022

      Meet Jared Birchall, Elon Musk’s personal ‘fixer’

      6 May 2022

      Twitter takeover was brash and fast, with Musk calling the shots

      26 April 2022
    • Podcasts

      Dean Broadley on why product design at Yoco is an evolving art

      18 May 2022

      Everything PC S01E02 – ‘AMD: Ryzen from the dead – part 2’

      17 May 2022

      Everything PC S01E01 – ‘AMD: Ryzen from the dead – part 1’

      10 May 2022

      Llew Claasen on how exchange controls are harming SA tech start-ups

      2 May 2022

      The inside scoop on OVEX’s big expansion plans

      20 April 2022
    • Opinion

      A proposed solution to crypto’s stablecoin problem

      19 May 2022

      From spectrum to roads, why fixing SA’s problems is an uphill battle

      19 April 2022

      How AI is being deployed in the fight against cybercriminals

      8 April 2022

      Cash is still king … but not for much longer

      31 March 2022

      Icasa on the role of TV white spaces and dynamic spectrum access

      31 March 2022
    • Company Hubs
      • 1-grid
      • Altron Document Solutions
      • Amplitude
      • Atvance Intellect
      • Axiz
      • BOATech
      • CallMiner
      • Digital Generation
      • E4
      • ESET
      • Euphoria Telecom
      • IBM
      • Kyocera Document Solutions
      • Microsoft
      • Nutanix
      • One Trust
      • Pinnacle
      • Skybox Security
      • SkyWire
      • Tarsus on Demand
      • Videri Digital
      • Zendesk
    • Sections
      • Banking
      • Broadcasting and Media
      • Cloud computing
      • Consumer electronics
      • Cryptocurrencies
      • Education and skills
      • Energy
      • Fintech
      • Information security
      • Internet and connectivity
      • Internet of Things
      • Investment
      • IT services
      • Motoring and transport
      • Public sector
      • Science
      • Social media
      • Talent and leadership
      • Telecoms
    • Advertise
    TechCentralTechCentral
    Home»Promoted Content»DDoS and RDoS attacks: What’s happening and how to fight back

    DDoS and RDoS attacks: What’s happening and how to fight back

    Promoted Content By Obscure Technologies29 October 2019
    Facebook Twitter LinkedIn WhatsApp Telegram Email

    In the last week, Radware’s Emergency Response Team (ERT) has been tracking an emerging global ransom denial-of-service (RDoS) campaign from a group identifying itself as the Russian cyber-espionage group Fancy Bear.

    This campaign is similar to the one Radware reported on two years ago. This new group has been distributing extortion e-mails to financial institutions globally for the past week. As of this moment, victims are still receiving ransom notes.

    Background

    In mid-October 2019, Radware’s ERT began mitigating sample attacks launched by an RDoS group claiming to be Fancy Bear. The extortionists currently behind this campaign attempted to intimidate their victims by using the name of APT28 (Fancy Bear), an infamous cyber-espionage group.

    APT28 is a Russian-backed cyber-espionage group that is also known as Pawn Storm, Sofacy Group, Tsar Team and Fancy Bear and is notorious for international hacking related to influence and disinformation operations. RDoS attacks are not the modus operandi of Fancy Bears to date.

    Starting in October 2019, almost 2 years after the first major campaign leveraged the name, Fancy Bear began appearing on extortion letters again in a new RDoS campaign. This time, Fancy Bear is requesting two bitcoins, US$17 400 at the time of delivery, with the ransom increasing by one bitcoin every day without payment.

    Figure 1: 2019 Fancy Bear extortion letter (current)

    What is an RDoS campaign?

    RDoS campaigns are extortion-based distributed denial-of-service (DDoS) attacks motivated by monetary gain. Attacks typically start with the perpetrators sending a letter threatening to attack an organisation — rendering its business, operations or capability unavailable — unless a ransom is paid by the deadline. To validate the threat, attackers will often launch a sample attack on the victim’s network.

    This extortion method has grown in popularity every year since 2010 and typically comes in the form of a volumetric DDoS attack. The method was initially introduced by DD4BC and has been replicated by several groups over the years. RDoS group will typical accompany their ransom demand with a short “demo” attack.

    Prior RDoS groups were methodical and achieved high success rates. However, today many groups imitate prior tactics and techniques. They spread similar ransom threats using other group names as a form of intimidation with no intention (or limited capacity) of launching an attack.

    Targets

    Currently, the group claiming to be Fancy Bear is targeting a number of financial services organisations around the world. Attacks have been observed in South America, Africa, northern Europe and parts of Asia. In the note, the attackers list a specific IP address of the victim network and target it with a sample attack. The selection of the specific IP address shows that the attackers are researching targeted network for maximum impact. As of this moment, sample attacks range between 40Gbit/s and 60Gbit/s. No follow-up attacks have been observed.

    Attack methods

    Most of these DDoS-for-ransom groups that launch attacks are running their own botnet. However, some leverage publicly available stressers to conduct campaigns. When experiencing an RDoS attack from this type of group, expect 40Gbit/s to 60Gbit/s and multiple vectors of attacks simultaneously. A sample attack is likely to last anywhere between 15 minutes to a few hours. In the past, Radware’s ERT has mitigated follow-up attacks that have been persistent and lasted for days. Current attack vectors in this campaign include floods using the following protocols:

    • SSDP
    • NTP
    • DNS
    • CLDAP
    • WSD
    • ARMS
    • SYN
    • ICMP

    The group carrying out the recent wave of RDoS attacks under the name Fancy Bear are currently launching large-scale, multi-vector demo DDoS attacks when sending victims the ransom note. One of the more notable attack vectors from this campaign was the use of Web Service Dynamic Discovery (WSD) protocol, UDP/3702 for amplification. While this attack vector has been known since the beginning of the year, no one publicly spoke about it until the third quarter when details began to slowly emerge that bot-herders had employed a new attack vector into their amplification toolkit.

    Figure 2: WSD attack vector offered via DDoS-for-hire

    Another notable attack vector from this campaign is the newly discovered vector that allows attackers the ability to abuse Apple’s Remote Management Service (ARMS) to launch an amplified denial-of-service attack. By sending malicious datagrams to exposed ARMS services on UDP/3283, attackers could gain an amplification factor of 35.5 to 1.

    Dealing with a ransom letter

    Companies are advised not to pay an extortionist and seek professional assistance for mitigating RDoS attacks. Such a threat usually provokes the need for a scrubbing service, ACL/BGP reconfiguration, as well as the usual DDoS protection essentials to assure uptime and service-level agreements.

    Evaluation – is it real or fake?

    Although it is almost impossible to determine whether a ransom note comes from a competent, experienced hacker group or an amateur unit, some units emerged under the guise of notorious hacking crews. While these fake groups send e-mails nearly identical to real ransom letters, there are several indicators to distinguish between the two:

    1. The fake groups often request a different amount of money
    2. “Real” groups prove their competence; fake groups exclude the “demo” attack
    3. These groups do not have official accounts, websites or target lists
    4. When hackers launch real DDoS for ransom attacks, they normally target many companies under the same industry
    5. Look for suspicious indicators. Is this group known for DDoS attacks?
    Figure 3: 2017 Fancy Bear extortion letter

    Effective DDoS protection essentials

    • Real-time signature creation: Promptly protect from unknown threats and zero-day attacks. In this current campaign, Radware’s ERT has been able to mitigate all vectors of attacks from the Fancy Bear RDoS group.
    • Hybrid DDoS protection: On-premise and cloud DDoS protection for real-time DDoS attack prevention that also addresses high-volume attacks and protects from pipe saturation.
    • Behavioural-based detection: Quickly and accurately identify and block anomalies while allowing legitimate traffic through.
    • A cybersecurity emergency response plan: A dedicated emergency team of experts who have experience with Internet of things security and handling IoT outbreaks

    For further network and application protection measures, Radware urges companies to inspect and patch their network in order to defend against risks and threats. To know more about today’s attack vector landscape, understand the business impact of cyberattacks or learn more about emerging attack types and tools, visit DDoSWarriors.com.

    For more information on Radware’s security solutions, contact the Obscure team: e-mail [email protected] or visit the website at www.obscuretech.net.

    • This promoted content was paid for by the party concerned
    Fancy Bear Obscure Obscure Technologies Radware Radware ERT
    Share. Facebook Twitter LinkedIn WhatsApp Telegram Email
    Previous ArticleiOCO: South Africa’s technology-agnostic ERP systems integrator
    Next Article Atlas Tower to sell South African tower assets for R2-billion

    Related Posts

    Fast-rising fintech Bankingly closes $11m investment round

    20 May 2022

    Creating an effective employer value proposition for the new era of work

    20 May 2022

    Why fibre is the new utility – and what it means for South Africa

    19 May 2022
    Add A Comment

    Comments are closed.

    Promoted

    Fast-rising fintech Bankingly closes $11m investment round

    20 May 2022

    Creating an effective employer value proposition for the new era of work

    20 May 2022

    Why fibre is the new utility – and what it means for South Africa

    19 May 2022
    Opinion

    A proposed solution to crypto’s stablecoin problem

    19 May 2022

    From spectrum to roads, why fixing SA’s problems is an uphill battle

    19 April 2022

    How AI is being deployed in the fight against cybercriminals

    8 April 2022

    Subscribe to Updates

    Get the best South African technology news and analysis delivered to your e-mail inbox every morning.

    © 2009 - 2022 NewsCentral Media

    Type above and press Enter to search. Press Esc to cancel.