Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label DDOS Attacks. Show all posts
Technology
DDOS Attacks Microsoft phishing Ransomware Technology

600 Million Daily Cyberattacks: Microsoft Warns of Escalating Risks in 2024


Microsoft emphasized in its 2024 annual Digital Defense report that the cyber threat landscape remains both "dangerous and complex," posing significant risks to organizations, users, and devices worldwide.

The Expanding Threat Landscape

Every day, Microsoft's customers endure more than 600 million cyberattacks, targeting individuals, corporations, and critical infrastructure. The rise in cyber threats is driven by the convergence of cybercriminal and nation-state activities, further accelerated by advancements in technologies such as artificial intelligence.

Monitoring over 78 trillion signals daily, Microsoft tracks activity from nearly 1,500 threat actor groups, including 600 nation-state groups. The report reveals an expanding threat landscape dominated by multifaceted attack types like phishing, ransomware, DDoS attacks, and identity-based intrusions.

Password-Based Attacks and MFA Evasion

Despite the widespread adoption of multifactor authentication (MFA), password-based attacks remain a dominant threat, making up more than 99% of all identity-related cyber incidents. Attackers use methods like password spraying, breach replays, and brute force attacks to exploit weak or reused passwords1. Microsoft blocks an average of 7,000 password attacks per second, but the rise of adversary-in-the-middle (AiTM) phishing attacks, which bypass MFA, is a growing concern.

Blurred Lines Between Nation-State Actors and Cybercriminals

One of the most alarming trends is the blurred lines between nation-state actors and cybercriminals. Nation-state groups are increasingly enlisting cybercriminals to fund operations, carry out espionage, and attack critical infrastructure1. This collusion has led to a surge in cyberattacks, with global cybercrime costs projected to reach $10.5 trillion annually by 2025.

The Role of Microsoft in Cyber Defense

Microsoft's unique vantage point, serving billions of customers globally, allows it to aggregate security data from a broad spectrum of companies, organizations, and consumers. The company has reassigned 34,000 full-time equivalent engineers to security initiatives, focusing on enhancing defenses and developing phishing-resistant MFA. Additionally, Microsoft collaborates with 15,000 partners with specialized security expertise to strengthen the security ecosystem.

Read more »
Oracle Weblogic Server
Crypto Mining DDOS Attacks Hadooken Malware malware Oracle Weblogic Server

Crypto Mining and DDoS Threats: How Hadooken Malware Targets Oracle Web Logic Servers

Crypto Mining and DDoS Threats: How Hadooken Malware Targets Oracle Web Logic Servers

Threat actors were found exploiting poorly secured Oracle WebLogic servers for mining cryptocurrency, building a DDoS botnet, and other malicious activities. 

The Discovery

Researchers from Aqua Cybersecurity found various attacks in the wild and decided to catch culprits by running a honeypot (a cybersecurity technique that creates a decoy system to trick and trap threat actors). Soon after, the experts found a threat actor breaking through weak passwords, and installing a malware called “Hadooken.”

The malware was used in a few other attacks in recent times, and it has two primary functions- a DDoS botnet and cryptocurrency mining. Besides this, the malware gives threat actors complete control over the compromised endpoint. 

About Hadooken Malware

Oracle WebLogic is a Java-based application that allows the management, development, and deployment of enterprise-level apps. It is generally used in financial and banking services, telecommunications, public services, and government organizations. Because of its popularity, WebLogic has also become a major target for threat actors as has “various vulnerabilities” The Register reports. 

Impact on Organizations

Until now, the experts found threat actors use Hadooken for mining crypto, while other functions are yet to be used. Experts also believe that Hadooken has hints of ransomware functions. “It could be the threat actor will introduce this attack to a Linux ransomware as well, or it is already introduced if the malware runs on the system longer than a sandbox execution,” the experts said.

When researchers tracked the IP addresses of the Hadooken malware, they came across tow IP addresses, one IP belongs to a UK hosting company, but it is registered in Germany. Earlier, the address was associated with TeamTNT and Gang 8220, but this link is not strong evidence to connect these attacks with threat actors, according to the experts. The second IP address belongs to Russia, registered with the same hosting company, but currently inactive.

How Hadooken Works

Haddoken abuses flaws in the Oracle WebLogic servers. These flaws come from unpatched misconfigurations or unpatched software. Once the malware gets access, it makes a foothold in the system, letting threat actors perform remote commands. 

Hadooken’s ability to steal passwords is a concern, it captures login credentials, and threat actors can move laterally inside a network, gaining access to other systems and data. It can cause more data breaches and ransomware attacks.
Read more »
Manufacturing
Botnet Camera DDOS Attacks Device Vulnerability malware Manufacturing

The Corona Mirai Botnet: Exploiting End-of-Life IP Cameras

The Corona Mirai Botnet: Exploiting End-of-Life IP Cameras

A recent report by Akami experts highlights a troubling trend: the exploitation of a five-year-old zero-day vulnerability in end-of-life IP cameras by the Corona Mirai-based malware botnet. This blog delves into the details of this issue, its implications, and the broader lessons it offers for cybersecurity.

The Vulnerability in AVTECH IP Cameras

The specific target of this malware campaign is AVTECH IP cameras, which have been out of support since 2019. These cameras are no longer receiving security patches, making them prime targets for cybercriminals. The vulnerability in question is a remote code execution (RCE) zero-day, which allows attackers to inject malicious commands into the camera’s firmware via the network. This particular exploit leverages the ‘brightness’ function in the camera’s firmware, a seemingly harmless feature that has become a gateway for malicious activity.

The Corona Mirai-Based Malware Botnet

The Corona Mirai-based malware botnet is a variant of the infamous Mirai botnet, which has been responsible for some of the most significant distributed denial of service (DDoS) attacks in recent history. By exploiting the RCE vulnerability in AVTECH IP cameras, the malware can gain control over these devices, adding them to its botnet. Once compromised, these cameras can be used to launch DDoS attacks, overwhelm networks, and disrupt services.

The Implications of Exploiting End-of-Life Devices

The exploitation of end-of-life devices like AVTECH IP cameras underscores a critical issue in cybersecurity: the risks associated with using outdated and unsupported technology. When manufacturers cease support for a device, it no longer receives security updates, leaving it vulnerable to new threats. In the case of AVTECH IP cameras, the lack of patches for the RCE vulnerability has made them easy targets for cybercriminals.

This situation highlights the importance of regular updates and patches in maintaining the security of devices. It also raises questions about the responsibility of manufacturers to provide long-term support for their products and the need for users to replace outdated technology with more secure alternatives.

Experts Suggest These Steps

  • Ensuring that all devices receive regular updates and patches is crucial in protecting against new vulnerabilities. Users should prioritize devices that are actively supported by manufacturers.
  • Manufacturers should clearly communicate end-of-life policies and provide guidance on replacing outdated devices. Users should be aware of these policies and plan for timely replacements.
  • Implementing network segmentation can help contain the impact of compromised devices. By isolating vulnerable devices from critical systems, organizations can reduce the risk of widespread damage.

Read more »
Ukraine-Russia Conflict
Bank Hacking Cyber Attacks data security DDoS DDOS Attacks Russian Cyber Security Ukraine-Russia Conflict

DDoS Attacks Disrupt Major Russian Banks: Ukraine Claims Responsibility

 

Several major Russian banks experienced distributed denial-of-service (DDoS) attacks, disrupting their online services and mobile apps. On Wednesday, local media reported that state-owned VTB Bank was among those affected. The bank informed the state news agency TASS that an attack “planned from abroad” caused disruptions for its clients trying to access online services. 

The Russian Agricultural Bank also reported being targeted by a DDoS attack on Tuesday. However, the bank noted that the impact was minimal due to their implementation of an enhanced system to combat such attacks. Gazprombank, the third-largest private bank in Russia, faced difficulties with its app’s transaction services due to the attack, though the issue was quickly resolved. Other banks, including Alfa Bank, Rosbank, and Post Bank, were also reportedly affected. 

On Wednesday, Ukraine’s military intelligence (HUR) claimed responsibility for the DDoS campaign targeting the Russian banking sector. An anonymous source within HUR, speaking to Ukrainian media, mentioned that the attacks also affected several Russian payment systems and large telecom operators such as Beeline, Megafon, Tele2, and Rostelecom. While this claim has not been independently verified, the HUR official stated that the attack “is still ongoing and far from over.” 

This incident is part of a series of cyberattacks by Ukrainian entities against Russian targets. In October, pro-Ukrainian hackers and Ukraine’s security service (SBU) claimed to have breached Russia’s largest private bank, Alfa-Bank. In January, data allegedly belonging to 30 million Alfa-Bank customers was released by attackers involved in the breach. Earlier this year, the hacker group Blackjack, in cooperation with the SBU, breached a Moscow internet provider in retaliation for a Russian cyberattack on Ukraine’s largest telecom company, Kyivstar. 

While not all reports from Ukrainian hackers or intelligence officials can be independently verified, the recent DDoS attacks on Russian banks had noticeable consequences, despite Russian claims of minimal impact. DDoS attacks are generally easier to mitigate, but this campaign stands out for its broad impact on multiple financial institutions and service providers. The ongoing cyber warfare between Ukraine and Russia underscores the escalating digital conflict between the two nations. Both sides have been leveraging cyber capabilities to disrupt each other’s critical infrastructure. 

The recent attacks highlight the necessity for robust cybersecurity measures and swift response strategies to minimize the impact on essential services and ensure the security of digital transactions. As cyber threats evolve, both nations will likely continue to enhance their defenses to protect against such incursions.
Read more »
Sweden
Cyber Security Cyberattacks DDOS Attacks Hackers NATO Safety Sweden

Sweden Faces Influx of DDoS Attacks Following NATO Membership

 


A significant uptick in distributed denial of service (DDoS) attacks has plagued Sweden as the nation navigates its path towards joining NATO, reports network performance management provider Netscout.

The onslaught commenced notably in May 2023, following a colossal 500 Gbps attack targeting Swedish government infrastructure. Subsequent to this initial strike, the frequency and intensity of DDoS assaults against Swedish entities have steadily escalated, reaching a peak in late 2023 with attacks soaring to 730 Gbps.

However, the year 2024 witnessed a further exacerbation of the situation, particularly intensifying from February onwards. On February 14, Sweden’s Foreign Minister hinted at Hungary's support for their NATO bid, serving as a catalyst for a significant event. 

Netscout documented an astounding 1524 simultaneous DDoS attacks targeting Swedish organizations the subsequent day. This surge indicated a marked escalation in tensions and retaliatory actions from various politically motivated hacker groups, as underscored in Netscout's public statement.

The climax of the attacks occurred on March 4, 2024, when Netscout observed an unprecedented 2275 attacks in a single day, marking a staggering 183% increase compared to the same date in the previous year. Remarkably, this surge transpired merely three days before Sweden's formal admission into NATO.

Netscout's analysis has identified several hacker groups involved in these assaults, including NoName057, Anonymous Sudan, Russian Cyber Army Team, and Killnet, all of which are aligned with Russian interests.
Read more »
NKN protocol
Blockchain Technology Cyber Security Cybersecurity DDOS Attacks multi-platform threat NKAbuse NKN protocol

NKAbuse Malware Utilizes NKN Blockchain Technology for Executing DDoS Attacks

 

A newly identified multi-platform threat named NKAbuse has surfaced, employing a decentralized peer-to-peer network connectivity protocol known as NKN (New Kind of Network) for communication. Russian cybersecurity firm Kaspersky detailed the malware's capabilities in a report, describing it as a robust implant with both flooder and backdoor functionalities.

NKN, boasting over 62,000 nodes, functions as a software overlay network on the existing Internet, allowing users to share unused bandwidth and earn token rewards through a blockchain layer on top of the TCP/IP stack. NKAbuse, however, takes advantage of this technology to execute distributed denial-of-service (DDoS) attacks and operate as an implant within compromised systems.

While threat actors commonly exploit emerging communication protocols for command-and-control purposes to elude detection, NKAbuse stands out by leveraging blockchain technology. This malicious software communicates with the bot master using the NKN protocol, implementing the Go programming language. Its primary targets seem to be Linux systems, including IoT devices, particularly in Colombia, Mexico, and Vietnam.

The scale of the attacks remains uncertain, but Kaspersky highlighted an incident involving the exploitation of a six-year-old critical security flaw in Apache Struts (CVE-2017-5638, CVSS score: 10.0) to breach an unnamed financial company. The attack sequence involves the delivery of an initial shell script, responsible for downloading the implant from a remote server after verifying the target host's operating system. The server hosting the malware supports various CPU architectures, featuring eight different versions of NKAbuse.

Notably, NKAbuse lacks a self-propagation mechanism, requiring delivery through an initial access pathway, such as exploiting security flaws. The malware employs cron jobs to persist through reboots, checking the user ID and, if it is root (ID 0), adding itself to the crontab for every reboot.

The malware also incorporates backdoor features enabling it to send periodic heartbeat messages to the bot master, providing system information, capturing screenshots, performing file operations, and executing system commands. Kaspersky emphasizes that NKAbuse is crafted for integration into a botnet but can adapt to functioning as a backdoor on a specific host. The use of blockchain technology ensures reliability and anonymity, hinting at the potential for the botnet to expand steadily over time without an identifiable central controller.

Zheng "Bruce" Li, co-founder of NKN, expressed surprise at the misuse of NKN technology, emphasizing that NKN was designed to offer secure, private, decentralized, and scalable peer-to-peer communication. He expressed a willingness to collaborate with security experts to enhance internet safety.
Read more »
Sensitive data
Data Breach DDOS Attacks Digital Age Malicious actor Open Source Sensitive data

Blender's Battle: Triumph Over DDoS Adversity

Open-source projects are now the foundation of innovation in a world where digital infrastructure is becoming more and more important. Even these groups, though, appear to be vulnerable to the constant threat of cyberattacks. The Blender Project was recently the target of Distributed Denial of Service (DDoS) assaults, which serve as a sobering reminder of the difficulties facing open-source endeavors in the digital age.

Blender, a versatile and powerful 3D creation suite, found itself in the crosshairs of a major DDoS attack, temporarily knocking its servers offline. The assault disrupted services, leaving users unable to access crucial resources. However, the Blender community, known for its resilience and collaborative spirit, swiftly rallied to address the challenge head-on.

The attack's origins remain shrouded in mystery, but the Blender Foundation acknowledged the incident through an official statement. They detailed the ongoing efforts to mitigate the impact and restore normalcy. Open source projects often operate on limited resources, making them susceptible targets for malicious actors. Despite this vulnerability, Blender's response underscores the dedication and determination of the open-source community to safeguard its assets.

Blender's official website (blender.org) became a focal point for concerned users seeking updates on the situation. The Blender Foundation utilized its communication channels to keep the community informed, ensuring transparency during the crisis. Users were encouraged to stay vigilant and patient as the team worked diligently to resolve the issue.

TechRadar reported on the severity of the attack, emphasizing the temporary unavailability of Blender's servers. The Verge also covered the incident, shedding light on the disruptive nature of DDoS attacks and their potential ramifications for widely-used platforms. Such incidents serve as a stark reminder of the importance of cybersecurity for digital infrastructure.

Despite the challenges posed by the DDoS onslaught, the Blender community's commitment to open-source principles emerged as a beacon of hope. The Blender Foundation's response exemplifies the resilience ingrained in collaborative endeavors. This incident reinforces the need for continued vigilance and proactive security measures within the open-source ecosystem.

As Blender emerges from this cyber crisis, it stands not only as a symbol of resilience but also as a reminder of the collective strength that open-source projects embody. The challenges posed by DDoS attacks have sparked a renewed commitment to fortifying the digital defenses of open-source initiatives. The Blender community's ability to weather this storm reflects the collaborative spirit that defines the open-source landscape, leaving us hopeful for a future where innovation can thrive securely in the digital realm.

Read more »
DDOS Attacks
airline industry Anonymous Hackers Data Breach DDOS Attacks

SAS Airlines Faces $3 Million Ransom Demand After DDoS Attacks

 

Scandinavian Airlines (SAS) has recently become the target of a series of Distributed Denial of Service (DDoS) attacks, resulting in a $3 million ransom demand from a hacker group called Anonymous Sudan. This incident highlights the increasing sophistication and financial motivations behind cyberattacks on major organizations.

The DDoS attacks, which overwhelmed SAS's computer systems and disrupted its online operations, were followed by a ransom note demanding the hefty sum of $3 million in exchange for stopping the attacks and preventing further damage. The hackers threatened to expose sensitive data and continue their assault if the ransom was not paid within a specified timeframe.

The airline industry has been a recurring target for cybercriminals due to the potentially massive financial losses and disruption caused by such attacks. In this case, SAS faced significant operational challenges as its website and other online services were rendered inaccessible to customers, leading to a loss of revenue and damaging its reputation.

Responding to the situation, SAS promptly notified the appropriate authorities and engaged with cybersecurity experts to mitigate the ongoing attacks. The company also worked to restore its affected systems and strengthen its overall security posture to prevent future incidents. Collaboration with law enforcement agencies and cybersecurity professionals is crucial in investigating these attacks and bringing the perpetrators to justice.

The incident serves as a reminder for organizations to enhance their cybersecurity measures and be prepared for the evolving threats posed by cybercriminals. Proactive steps, such as conducting regular security assessments, implementing robust network infrastructure, and educating employees about potential risks, can help mitigate the impact of such attacks.

Incident response planning should also be given top priority by enterprises in order to reduce downtime and financial losses in the case of an attack. This entails developing a clear plan for confining and isolating the assault, recovering systems and data from backups, and keeping open lines of communication with key stakeholders all along the procedure.

The SAS Airlines ransom demand serves as a sobering reminder of the constant threat posed by cyberattacks and the significant financial implications for targeted organizations. Heightened cybersecurity measures, swift incident response, and collaboration among industry stakeholders are crucial in combatting these threats and safeguarding critical infrastructure from malicious actors.

Read more »
Vulnerability and Exploits.
DDOS Attacks Firewalls Malicious actor SMB Software Vulnerability and Exploits.

SLP Vulnerability Exposes Devices to Powerful DDoS Attacks

Security researchers have recently discovered a new vulnerability that has the potential to launch devastating Distributed Denial of Service (DDoS) attacks. The Server Message Block (SMB) protocol, which is widely used in various devices and systems, including Windows machines and some network-attached storage devices, contains the SLP vulnerability. Attackers can exploit this vulnerability to send specially crafted SMB packets that force the target device to allocate excessive memory or processing power to the request, ultimately causing a crash or downtime.

The SLP vulnerability is particularly dangerous because it enables attackers to amplify the impact of their DDoS attacks by up to 2200 times more than previous methods. This increased power can overwhelm the target’s defenses and cause lasting damage. Unfortunately, there is no straightforward solution for this vulnerability as it is deeply embedded in the SMB protocol and affects various devices and systems. However, organizations can take some steps to mitigate the risk of attack, such as implementing access controls, and firewalls, and monitoring their networks for any suspicious SMB activity.

The discovery of the SLP vulnerability highlights the need for robust cybersecurity measures and constant vigilance against evolving threats. As attackers develop new tactics and exploit new vulnerabilities, organizations must stay ahead of the curve and protect their networks and systems from harm.

The SLP vulnerability is a significant concern for organizations that use SMB protocol, as it exposes them to potential DDoS attacks. The impact of these attacks can be devastating and long-lasting, highlighting the need for constant vigilance and strong cybersecurity measures. Organizations must take proactive steps to monitor their networks, implement access controls, and limit the exposure of SMB services to the internet to mitigate the attack risk. The discovery of the SLP vulnerability underscores the critical importance of staying ahead of the curve in cybersecurity and constantly adapting to new threats.
Read more »
IP Address
Botnet Cloud Computing Cloudfare Cyber Attacks DDOS Attacks FBI HTTP IP Address

 Massive DDoS Attack was Thwarted by Cloudflare

 

Prioritized firms like gaming providers, hosting providers, cloud computing platforms, and cryptocurrency enterprises, according to Cloudflare, emanated from more than 30,000 IP addresses.
The greatest volumetric distributed denial-of-service (DDoS) attack that Cloudflare has seen to date was stopped.

The greatest attack, which is the largest documented HTTP DDoS attack, topped 71 million rps, per Cloudlare's analysis. The volume is 35% greater than the previous record, 45 million rps from June 2022, which had been recorded.

The FBI accused six suspects of their involvement in running 'Booter' or 'Stresser' platforms, which anybody can use to execute DDoS attacks, in response to this stream of continuously escalating attacks, and seized dozens of Internet domains. Operation PowerOFF, a larger, more coordinated worldwide law enforcement operation against DDoS-for-hire services, included the action.

Cloudflare has been collaborating with the victims to strike down the botnet and is providing service providers with a free botnet threat feed that will transmit threat intelligence from their IP and any ongoing attacks coming from their hosted autonomous system.

Researchers cautioned entities to take action immediately before the next campaign: protecting against DDoS attacks is crucial for organizations of all sizes, even while DDoS attacks on non-critical websites might not result in permanent harm or safety hazards. DDoS attacks against internet-facing equipment and patient-connect technology in the healthcare industry put patients' safety at risk.



Read more »
User Privacy
Artificial Intelligence Data protection DDOS Attacks malware Network Attacks User Privacy

DDoS Attacks Can Be Mitigated by AI

A DDoS protection system is necessary since DDoS attacks are so common. Numerous media and web-based consumer platforms are supported by AI machine learning algorithms currently. AI does not need the ten-year development cycles of nuclear weapons or bombers to be deployed or even upgraded because it is mostly software running on commercial processors.

Along with speed and accuracy, the rate of false positives shows how effective your detection is; the smaller the number, the better. Up until recently, neutralizing a DDoS assault of 2Tbps in scale might also block 100Gbps to 200Gbps of valid network traffic due to the industry-accepted rate of 5% to 10% false positives.  

Investment may be necessary for the implementation of ML and AI technologies. Based on the expertise working across numerous sectors, researchers have found important factors that can make any AI/ML implementation much more effective, resulting in a successful deployment as opposed to AI technology remaining on the stand and improved return on investment.

Ways ML/AI technologies can be utilized

1. Finding operational challenges:

The first step to the successful adoption of any AI or ML solution is to pinpoint the business issues the organization is attempting to solve with AI/ML and secure support from all important stakeholders. The roadmap for getting there can be created by being clear about the preferred result and evaluating use cases motivated by business imperatives and quantitative success factors of an AI/ML implementation. 

2. Data accessibility:

To develop the AI/ML model, a sufficient database that is pertinent to the business challenge being addressed must be made available. Organizations may encounter circumstances where such data is not yet accessible. The company should next devise and carry out a plan to begin gathering pertinent data while concentrating on other business issues that can be helped by accessible data science. 

3. Adopting optimal algorithms to perform:

It is frequently preferable to use a model or method with fewer parameters. Examining model validity is a crucial stage in this process, can the chosen model provide rationales and explanations in simple English that can be understood. Reasons for judgments made by an expert or algorithm are necessary in some regulated businesses. . In such cases, model explainability packages like LIME or SHAP can offer explanations that are simple enough for humans to understand.

4. Approach to operationalization:

It is apparent that a successful deployment requires clarity regarding how the forecasts and insights from AI/ML fit into routine operations. The model scores and insights will be used in what ways by the organization? In the operational workflow, how does the AI/ML model fit? Will technology entirely replace parts of the present manual processes, or will it only be utilized to support the analysts' judgment? Will the solution be applied on-premises or in the cloud? A clear plan that answers these issues will help to ensure that the solution is implemented and does not remain on the back burner.

5. Educating, enabling, and skilling:

Building teams with specialists in multiple fields of the AI/ML domain is crucial, of course. Confirm that the resources and expertise necessary to support the functioning of the AI/ML solution are accessible. Any skills shortages should be filled by either retraining the current workforce or hiring fresh talent with the necessary qualifications.

AI/ML algorithms now make it possible to identify DDoS activity early and put in place quick, precise, and effective mitigation procedures to resist such attacks.

Experts can protect our networks from harmful DDoS attacks, keep the functioning of the service, and provide user protection online by integrating big data analytics and AI/ML into every phase of a thorough DDoS security strategy. 
Read more »
saaS
Cyber Crime Cyber Crime Reports DDoS DDOS Attacks DDoS Flaw Microsoft Ransomware saaS

A Huge DDoS Network was Taken Down by the US DOJ

 


According to the US Department of Justice (DOJ), 48 domains were seized after it was discovered that they were offering distributed denial of service (DDoS) attacks on-demand as a service that criminals could exploit.  

This information was provided in a press release from the office of E Martin Estrada, the United States Attorney for the Central District of California. This release was intended to inform the public that in addition to these seizures, six defendants are being charged with crimes in connection with operating these platforms.  
 
With the addition of the DDoS attacks which are plaguing the internet, this news brings back to the forefront the concept of Cybercrime-as-a-Service, outlined in the Microsoft Digital Defence Report (MDDR) released in November 2022. 

What is DDoS?

It is a platform for performing distributed denial-of-service attacks (DDoS attacks) that primarily allows anyone to purchase and execute such attacks for free. Based on the software as a service (SaaS) business model, these services are lucrative because they allow the owner of an IoT botnet to conduct low-overhead attacks.


DoS-for-Hire Services

Until recently, the majority of cybercrime-as-a-service reports have covered cybercrime using the context of ransomware, or a threat actor encrypting data and locking it out so that people cannot access what they want (usually until a ransom has been paid), or droppers bots that spread malware via delaying software updates.  

Despite this, DDoS-as-a-service (sometimes known as "booters" since they boot targeted systems from the internet) continues to be one of the most popular cybercrime methods for those who wish to commit a crime without having the necessary knowledge. 

According to the US Attorney's office, the websites seized during the operation launched "millions" of DDoS attacks, attacking victims around the world, with some claiming to provide legitimate services for your business to cope with stress. 

With booter services such as these, anyone can launch cyberattacks against victims, causing grave harm to individuals, and compromising the internet access of everyone, said US Attorney Estrada, noting the ease with which the attacks are carried out, allowing for maximum damage to be done. 

This week’s sweeping law enforcement activity is a considerable step in our ongoing efforts to eradicate criminal conduct that threatens the internet’s infrastructure and our ability to function in a digital world.

There are several organizations, including the FBI, the National Crime Agency, the Netherlands Police, and the National Crime Strategy, which are taking a much softer approach towards anyone who shows an interest in using the DDoS-for-hire services that are available. 

To deter would-be cybercriminals from investing in these services and to educate the public about the dangers of DDoS activity, an advertorial campaign will be conducted using placement ads in search engines on common keywords related to DDoS-for-hire activity. The campaign aims to target the use of common keywords related to DDoS-for-hire activity. As part of its commitment to victims, the FBI has also pledged to assist them whenever possible. 

"The FBI is ready to work with victims of crimes whether they launch them independently or hire a skilled contractor to execute them," said Donald Alway, Assistant Director in Charge of the FBI Los Angeles Field Office. 

American victims of cybercrime are encouraged to contact their local FBI field office or to file a complaint with the FBI's Internet Crime Complaint Center at www.ic3.gov.
Read more »
Vulnerabilities and Exploits
Akamai Bypass Methods DDOS Attacks Online Security RCE Flaw Vulnerabilities and Exploits

Researchers Find an Akamai WAF Access Point

The bypassing of Spring Boot-based Akamai web app firewalls (WAF) by a hacker could result in remote code execution (RCE).

The WAF from Akamai uses adaptive technologies to prevent known online security risks and was modified a few months ago in order to reduce the danger of Distributed Denial-of-Service (DDoS) attacks.

According to security researcher Peter M, the exploit employed Spring Expression Language (SpEL) injection, better known by the alias 'pmnh'. Usman Mansha and the analyst Peter H. claimed that Akamai has subsequently corrected the vulnerability, which was not given a CVE number.  

"This was the second RCE via SSTI we identified on this program, after the first one, the program added a WAF which we were able to overcome in a different portion of the application," GitHub explanation of the Akamai WAF RCE read. 

Access Point for WAF

The most straightforward approach to access the java.lang. Runtime class was through the SpEL reference $T(java.lang.Runtime), however, Akamai's software prevented this. 

Discovering a connection to a random class was the next step. Peter M., a technical writer, said that this would enable reflection-based or direct method invocation to access the desired method. 

Peter M. and Mansha constructed an arbitrary String using the java.lang and used a reflection mechanism to gain access to Class.forName.Accessible runtime value through Java.lang.

A second string was made to access the Runtime.getRuntime function and java.lang.Runtime, allowing for the creation of an effective RCE payload. The server recognized the final payload as a GET request because it was less than 3kb in size. 

The WAF was a difficult obstacle to get over, though. Finding an access point required more than 14 hours and 500 roughly designed tries, according to Peter M. In order to stop blatant copycats, the researcher chose not to provide the final payload in text format. 


Read more »
User Privacy
Cyber Crime DDOS Attacks EU Europol Phishing Attacks User Privacy

DDoS-for-Hire Websites are Seized by Authorities

 

According to Europol, international police deactivated roughly 50 well-known websites that charged users to perform distributed denial-of-service attacks and detained seven people who were allegedly the sites' administrators.

Operation Power Off was a coordinated effort by law enforcement agencies in the US, the Uk, the Netherlands, Poland, and Germany to combat attacks that have the potential to shut down the internet.

According to the police, the defendants misrepresented their websites as being services that could be employed for network testing while actually charging users for DDoS assaults against universities, government organizations, gaming platforms, and millions of people both domestically and overseas. Websites are rendered unavailable by DDoS attacks, which function by flooding them with unwanted traffic.

"These DDoS-for-hire websites, with paying customers both inside and outside the US, enabled network outages on a massive scale, targeting millions of victim computers around the world," said Antony Jung, special agent in charge of the operation at the FBI's field office in Anchorage, Alaska. Before purchasing or offering these illicit services, prospective users and administrators should exercise caution.

The largest DDoS-for-hire services are available on these sites, according to the UK's National Crime Agency (NCA), one of which has been used to launch more than 30 million attacks in its existence. Additionally, it has taken possession of customer data and, pending examination, may soon take legal action against UK site visitors.

DDoS Attack Is Illegal

DDoS poses the risk of lowering the barrier to entry for cybercrime. As per Europol, anyone with no technical expertise can start DDoS attacks with the press of a button for as little as $10, taking down entire networks and websites.

The harm they can cause to victims can be severe, financially crushing businesses and stripping people of necessary services provided by banks, governmental agencies, and law enforcement. Many young IT enthusiasts participate in this allegedly low-level crime feeling motivated by their imagined anonymity, unaware of the potential repercussions of such online activity.

The police take DDoS attacks seriously. Irrespective of their size, all users are monitored by law authorities, whether they are high-level hackers launching DDoS assaults against for-profit targets or casual users kicking their rivals out of video games.


Read more »
Google
Blockchain Cloud Services Crypto Currency Cyber Security DDOS Attacks Google

Google Cloud Delivers Web3 Developers for Blockchain Node Engine

The Blockchain still has more than 38 million customers in 140 countries worldwide, according to the Google Cloud website. In a news release, the business stated that the launch represents a resolve to aid Web3 developers in creating and deploying new products on platforms based on blockchain technology. 

Blockchains serve as a sort of decentralized database because they are made up of transaction data that is encrypted and permanently stored. The governing infrastructure is a node, which is a computer or server that holds the whole copy of the blockchain's transaction history in addition to depending on a central authority to confirm data.

Amit Zavery, GM and VP of engineering and platform, and James Tromans, director of cloud web3, announced the new service in a blog post that explained how difficult it is for blockchain nodes to stay in sync since they must continually exchange the most relevant blockchain data. It requires a lot of resources and data.

By providing a service model to handle node creation and a safe development environment in a fully managed product, Google Cloud aims to make it simpler. From Google's standpoint, it is far simpler to let them handle the labor-intensive tasks while you focus on creating your web3 application.

Additionally, Web3 businesses that need dedicated nodes can create effective contracts, relay transactions, read or write blockchain data, and more using the dependable and fast network architecture of Google Cloud. Organizations using Web3 benefit from quicker system setup, secure development, and managed service operations.

The goal of Google's blockchain service is to deploy nodes with the security of a virtual private cloud firewall that restricts networking and communication to vetted users and computers. The ability to access the notes from processes like distributed denial of service assaults will be restricted by other services like Google Cloud Armor.

Gains from Node Engine

The majority will adopt this method after Ethereum, which will employ it first. The following are some advantages that businesses could gain from using this Google Cloud Node Engine.

It takes a significant amount of time to manually node, and it can prove difficult for a node to sync with the network. However, the developers can deploy nodes using Google Cloud's Node Engine in a single transaction, simplifying and speeding up the procedure.

In the realm of cryptocurrency, data security is of utmost importance. The developers will benefit from the Engine Node's assistance in protecting their data and preventing illegal access to the nodes. Additionally, Google Cloud shields the nodes from DDoS assaults, just like Cloud Armor.

This development seeks to "assist enterprises with a stable, easy-to-use blockchain node web host so they can focus their efforts on developing and scaling their Web3 apps," according to Google Cloud's official website.

An approved group fully manages the Google Cloud Engine Node. The staff will administer the system during an outage, therefore you will have no concerns about availability. Nodes need to be restarted and monitored during an outage; the group will take care of it for clients.

Read more »
Russian Cyber Security
Cyber Attacks DDoS DDOS Attack DDOS Attacks Killnet Russia Russian Cyber Security

KillNet: Pro-Russian Threat Actors Claims Responsiblity for 14 DDoS Attacks on U.S. Airports

 

On Monday, a pro-Russian hackers group ‘KillNet reportedly claimed to be behind the DDoS attacks, that temporarily took down the websites of several U.S. airports.
 
A similar case was witnessed by Atlanta International Airport. Consequently, users were unable to access the websites for a few hours during the campaign. Though, the attacks did not have any impact on flight operations.
 
The Los Angeles International Airport (LAX) authority informed about a threat on their website to the Transportation Security Administration and the FBI.
 
"The service interruption was limited to portions of the public facing FlyLAX.com website only. No internal airport systems were compromised and there were no operational disruptions," a spokesperson stated in an emailed statement. Adding to the statement, she said the airport’s IT Team has restored all services and is investigating the cause.
 
Later, the hacker group apparently posted the list of the hacked airport websites on Telegram that included 14 targeted domains, urging hackers to participate in the DDoS attack.
 
The Airport websites impacted by the group include Los Angeles International, Chicago O’Hare, Hartsfield-Jackson Atlanta International Airport, the Los Angeles International Airport (LAX), the Chicago O’Hare International Airport (ORD), the Orlando International Airport (MCO), the Denver International Airport (DIA), the Phoenix Sky Harbor International Airport (PHX), and the sites of airports in Kentucky, Mississippi, and Hawaii.
 
In a Telegram post on Monday, Killnet listed other U.S. sites that could be the next potential victims of similar DDoS attacks, such as sea terminals and logistics facilities, weather monitoring centers, health care systems, subway systems, and exchanges and online trading systems.
 
Apparently, this DDoS attack was not the first attack by KillNet as KillNet has previously targeted many other countries that were against the Russian invasion of Ukraine. These NATO countries include Italy, Romania, Estonia, Lithuania, and Norway.
 
KillNet's DDoS attacks and those urging other threat actors to carry out are an example of what security experts determine is the tendency in recent years of geopolitical tensions, to be permeated the cyber world. As per the speculations, this campaign against the US and other NATO countries, for instance, instigates days after an explosion demolished a section of a major bridge connecting Russia to the Crimean Peninsula.
Read more »
Telegram
Command and Control(C2) Cyber Security DDOS Attacks Encryption Ransomware Attacks. Russian Hackers Telegram

Evolution of LilithBot Malware and Eternity Threat Group

A variant of the versatile malware LilithBot was recently uncovered by ThreatLabz in its database. This was connected to the Eternity group, also known as the Eternity Project, a threat entity affiliated with the Russian Jester Group, which has been operating since at least January 2022, according to further investigation.

In the darknet, Eternity disseminates many malware modules bearing the Eternity name, such as a stealer, miner, botnet, ransomware, worm+dropper, and DDoS bot.

LilithBot Malware

The distribution channels for the LilithBot that were found were a specialized Telegram group and a Tor connection that offered one-stop shopping for these multiple payloads. It included built-in stealer, clipper, and miner capabilities in addition to its primary botnet activity. 

The LilithBot multipurpose malware bot was discovered by Zscaler's ThreatLabz threat research team in July 2022 and was being offered as a subscription by the Eternity organization. In this campaign, the threat actor adds the user to its botnet and then steals files and user data by sending it via the Tor network to a command-and-control (C2) server. The malware in this campaign performs the functions of a stealer, miner, clipper, and botnet while using false certificates to avoid detection.

This malware-as-a-service (MaaS) is unusual because, in addition to using a Telegram channel to share updates on the latest features, it also uses a Telegram Bot to let customers create the binary. Common cryptocurrencies accepted by Eternity for payments include BTC, ETH, XMR, USDT, LTC, DASH, ZEC, and DOGE. Eternity often conducts business via Telegram.

If the buyer requests it, hackers will construct viruses with add-on functionality and offer customized viruses. The infection costs from $90 and $470 in USD. The Eternity Telegram channel demonstrates the frequent upgrades and improvements the team makes to its services.

The Eternity gang frequently refers users to a dedicated Tor link where a detailed description of their various viruses and their features may be found. The Tor link takes you to the homepage, where you can learn more about the different products and modules you may buy. The targeted user's files and documents are encrypted by the malware. A specific video explaining how to create the ransomware payload is available on the Tor page. Their Ransomware is the most expensive item on sale. For yearly membership, Eternity Stealer costs $260.
  • Eternity Miner as a yearly subscription costs $90.
  • Eternity Miner ($90 )as an annual subscription 
  • Eternity Clipper ($110 )
  • Eternity Ransomware ($490)
  • Eternity Worm ($390)
  • Eternity DDoS Bot (N/A) 

It is adaptable to the unique needs of clients and can constantly be updated at no further cost. They also provide their clients with numerous additional discounts and perks.

It is possible that the organization is still carrying out these tasks as the LilithBot malware has developed, but doing so in more complex ways, for as by completing them dynamically, encrypting the tasks like other areas of code, or employing other cutting-edge strategies.

The 'Microsoft Code Signing PCA' certificate authority issues a valid Microsoft-signed file, and it will also show a countersignature from Verisign. But as research is seen, LilithBot's bogus certificates lack a countersignature and appear to have been granted by the unverified Microsoft Code Signing PCA 2011.

Read more »
Windows
DDOS Attacks Infected Devices Linux malware Safety Security Windows

This New Chaos Malware Infects Windows & Linux Devices for DDoS Attacks

 

Lumen Technologies' threat intelligence team, Black Lotus Labs, has issued a warning about Chaos, a new variant of the Kaiji distributed denial-of-service (DDoS) botnet that targets enterprises and large organisations. 

The Golang-based Kaiji malware is presumed to be of Chinese origin and emerged in early 2020, targeting Linux systems and internet of things (IoT) devices via SSH brute force attacks. By mid-2020, the threat had expanded to include Docker servers. The recently discovered Chaos malware, like Kaiji, is written in Go and uses SSH brute force attacks to infect new devices. 

Additionally, it targets known vulnerabilities and infects with stolen SSH keys. The threat is compatible with multiple architectures, including ARM, Intel (i386), MIPS, and PowerPC, and it can run on both Linux and Windows, according to Black Lotus.

Chaos establishes persistence and connects to an embedded command and control (C&C) server after infecting a device. Following that, it receives staging commands, such as starting propagation via known CVEs or SSH or starting IP spoofing. The malware first creates a mutex on infected Windows systems by binding to a UDP port that it hides from the analysis. If the binding fails, the malware's process terminates.

After the initial set of staging instructions, Black Lotus Labs observed numerous additional commands being sent to bots. These commands would result in new propagation attempts, additional compromise of the infected device, DDoS attacks, or crypto-mining.

Chaos can also build a reverse shell on the target device by using an open-source script designed to run on Linux-native bash shells, allowing the attackers to upload, download, or modify files. From mid-June to mid-July, Black Lotus Labs observed hundreds of unique IP addresses representing Chaos-infected devices, followed by an increase in new staging C&C servers in August and September. The majority of infections occur in Europe, North and South America, and Asia-Pacific (but not Australia or New Zealand).

In September, the botnet was spotted launching DDoS attacks against the domains or IP addresses of over 20 organisations. The entities targeted are from various industries, including entertainment, finance, gaming, media, and hosting. It was also seen targeting DDoS-as-a-Service providers and a cryptocurrency mining exchange.

 Black Lotus Labs concluded, “Not only does it target enterprise and large organizations but also devices and systems that aren’t routinely monitored as part of an enterprise security model, such as SOHO routers and FreeBSD OS. And with a significant evolution from its predecessor, Chaos is achieving rapid growth since the first documented evidence of it in the wild.”
Read more »
Security
attackers attacks Cyber Attacks DDOS Attacks hack Hackers Imperva Security

Extended DDoS Attack With 25.3B+ Requests Thwarted

 

On June 27, 2022, the cybersecurity firm Imperva mitigated a DDoS attack with over 25.3 billion requests. The attack, according to experts, sets a new record for Imperva's application DDoS mitigation solution. The attack, which targeted an unnamed Chinese telecommunications company, was notable for its duration, lasting more than four hours and peaking at 3.9 million RPS. 

“On June 27, 2022, Imperva mitigated a single attack with over 25.3 billion requests, setting a new record for Imperva’s application DDoS mitigation solution” reads the announcement. “While attacks with over one million requests per second (RPS) aren’t new, we’ve previously only seen them last for several seconds to a few minutes. On June 27, Imperva successfully mitigated a strong attack that lasted more than four hours and peaked at 3.9 million RPS.”

The Chinese telecommunications company had previously been targeted by large attacks, and experts added that two days later, a new DDoS attack hit its website, albeit for a shorter period of time. This record-breaking attack had an average rate of 1.8 million RPS. To send multiple requests over individual connections, threat actors used HTTP/2 multiplexing or combining multiple packets into one.

The attackers' technique is difficult to detect and can bring down targets with a limited number of resources.

“Since our automated mitigation solution is guaranteed to block DDoS in under three seconds, we estimate that the attack could have reached a much greater rate than our tracked peak of 3.9 million RPS.” continues Imperva.

This attack was launched by a botnet comprised of nearly 170,000 different IP addresses, including routers, security cameras, and compromised servers. The compromised devices can be found in over 180 countries, with the majority of them in the United States, Indonesia, and Brazil.

Akamai mitigated the largest DDoS attack ever against one of its European customers on Monday, September 12, 2022. The malicious traffic peaked at 704.8 Mpps and appears to be the work of the same threat actor as the previous record, which Akamai blocked in July and hit the same customer.
Read more »
User Privacy
Akamai Command and Control(C2) Cyber Crime DDOS Attacks IP Address User Privacy

Akamai Sighted an Evolving DDoS attack in EU

 

The most recent DDoS attack record was set by Akamai in July, but it was surpassed on Monday, September 12, by a fresh attack. 

In a DDoS attack, cybercriminals flood servers with fictitious requests and traffic to block legitimate users from using their services.

According to the cybersecurity and cloud services provider Akamai, the recent attack looks to be the work of the same threat actor, indicating that the operators are now strengthening their swarm.

European businesses were the main targets of the current attack, according to Akamai. It peaked at 704.8 million packets per second, making it the second attack of this size against the same client in as few as three months and around 7% more powerful than the attack in July.

Prior to June 2022, this user primarily experienced attack traffic against the principal data center, as per Craig Sparling of Akamai. Six data center locations were hit by the threat actors' firepower in Europe and North America.

The day after it was discovered, the attack was stopped. This DDoS attack, while not the biggest ever, was notable because it was the biggest one on European organizations. The DDoS attack vector utilized by the attackers included UDP, along with ICMP, SYN, RESET floods, TCP anomaly, and PUSH flood.

The multidestination attack was immediately launched by the attackers' command and control system, increasing the number of active IPs per minute from 100 to 1,813 in just 60 seconds.

This expansion of the targeting area attempts to attack resources that aren't deemed essential and aren't effectively safeguarded, but whose absence will still be problematic for the company.

Published in July, the company saw 74 DDoS attacks, and 200 or more were added later. The business claimed that this campaign shows how hackers are always enhancing their attack methods to avoid detection. 

However, because the particular organization had safeguarded all 12 of its data centers in response to the July incident, 99.8% of the malicious traffic was already pre-mitigated.

The security company Akamai concluded, that having a solid DDoS mitigation platform and plan in place is essential for protecting your company from disruption and downtime.





Read more »
Subscribe to: Posts (Atom)