At least five South African web hosting and network providers have had services disrupted by large-scale distributed denial-of-service (DDoS) attacks since last Friday, in a run of incidents that one provider has tied to a ransom demand – raising fears that the country’s internet infrastructure is being targeted in an extortion campaign.

Network Platforms, 1-grid and Xneelo have all reported significant attacks.

For the latest on this story, read: DDoS extortionists ‘carpet bomb’ South African internet hosts

Also read: Troubling questions over South African internet infrastructure attacks

The clearest sign of an extortion motive came from Network Platforms, which was hit on Monday. The provider said the attack began at about 1.25pm and escalated quickly, with inbound traffic peaking at well over 300Gbit/s. It described a small-payload flood of junk network traffic aimed at multiple IP addresses, with the attackers shifting targets across the network over time and striking both its IP transit service and clients’ networks.

Critically, Network Platforms said it received ransom demands – and that neither it nor the affected clients engaged with or paid them. For that reason, it warned, there remained “a strong possibility” of renewed activity. As a precaution, the company has switched on DDoS scrubbing protection for every client on its network, including those who had never subscribed to the service.

1-grid, an SME-focused host, was also struck. The company, which says it serves more than 32 000 customers and hosts more than 77 000 websites, reported intermittent disruption from a large-scale attack on parts of its infrastructure, before later confirming the attack had been mitigated. 1-grid did not refer to any ransom demand.

Xneelo hit

The most recent provider to be affected is Xneelo, one of the country’s largest hosting companies. From early on Tuesday, Xneelo reported network degradation that left the KonsoleH management system, web hosting and e-mail hosting intermittently inaccessible.

By late morning, it had confirmed a large-scale DDoS attack and said it was treating the matter as a priority incident, with its status updates still describing the situation as “under investigation” – an indication the attack had not been fully mitigated.

It is not yet clear whether the three incidents are the work of the same attackers, and only Network Platforms has publicly linked its attack to extortion. But the clustering of large-scale attacks on local hosting providers, alongside a confirmed ransom demand, fits the pattern of a ransom DDoS – or RDoS – campaign, in which attackers disrupt a target’s services and demand payment to make the disruption stop.

Hosting providers are attractive targets because a single successful attack can ripple across hundreds or thousands of downstream customers, amplifying both the disruption and the pressure to pay. DDoS extortion has become a recurring tactic globally, but a cluster of attacks on this scale against South African infrastructure in a single window is unusual.

Get breaking news from TechCentral on WhatsApp. Sign up here.