Pierluigi Paganini September 11, 2015

According the Akamai firm, the criminal crews known as DD4BC has carried out at least 114 DDoS attacks with an average peak bandwidth of around 13.34 Gbps on its customers since April 2015.

The DD4BC group attempted to extort money from financial companies and other business by threatening to hit them with DDoS attacks that could interfere with their operations.

In one case, the DDoS attack flooded the target with over 56.2 Gbps of traffic, in June the run at least 8 DDoS attacks that had peak bandwidths of more than 23 Gbps.

“From June through July 2015, the attacks increased from low-level to more than 20 Gbps in some cases. The group would then demand a Bitcoin ransom to protect the company from a larger DDoS attack designed to make its website inaccessible.” states a report published today.

The DD4BC group targeted Financial services in 58 percent of the DDoS attacks, banks and credit unions in 35 percent of the attacks, currency exchanges in 13 percent while the rest were payment processing firms.

The experts are following the DD4BC group since September 2014, every attack carried by the DD4BC group was preceded by emails from the crooks that have attempted to extort money from the victims. The criminals request their victims the payment of a specific ransom amount in Bitcoins to stop the DDoS attack.

Akamai published samples of the extortion emails, the DD4BC group demanded ransom ranging from 25 Bitcoins to 50 Bitcoins ($6,000 and $12,000 at current currency exchange rates).

“Your site is going under attack unless you pay 25 Bitcoin,” one email stated. “Please note that it will not be easy to mitigate our attack, because our current UDP flood power is 400-500 Gbps, so don’t even bother.”

The attackers promise never to threaten the victim twice if they will pay the ransom.

“We do bad things, but we keep our word.”

In the case victims ignore the first message they will receive a subsequent email to warn them against ignoring the ransom demand.

“And you are ignoring us. Probably because you don’t want to pay extortionists. And you believe that after sometime we will give up. But we never give up,” the follow-up messages read.

The DD4BC group is considered very dangerous by Akamai, as explained by Lisa Beegle, manager at Akamai’s Prolexic Security Engineering & Research Team (PLXsert).

“This group has definitely followed through” Beegle says. “If an organization gets a note [from DD4BC], they should take it seriously,”

Akamai analyzed the “fire” capability of the DD4BC group, the experts speculate that the average organization has a 10 Gbps pipeline for this reason they exclude crooks  have the ability to launch the 400 to 500 Gbps attacks.

Pierluigi Paganini

(Security Affairs – DD4BC group, DDoS)

[adrotate banner=”5″]

[adrotate banner=”13″]