A hacker group named DD4BC, active since September 2014, has been blamed for over 141 DDOS attacks aimed at ransom.
The team, which was identified and analyzed by the Prolexic Security Engineering and Response Team (PLXsert) of Akamai, had been very active over the past few months, carrying out numerous DDOS attacks against Akamai's customers, demanding Bitcoins as ransom to stop their attacks.
Most of the attacks targeted Akamai's customers operating in the financial sector, where there are higher chances of extracting a Bitcoin payment compared to other industries.
This is due to the fact that companies with a financial focus tend to have larger losses for each minute of downtime, compared to other entities operating in the health, tourism, telecommunications sectors, or various other fields.
According to the Akamai report, most attacks are carried out via protocols such as NTP (Network Time Protocol), SSDP (Simple Service Discovery Protocol), UDP (User Datagram Protocol), TCP (Transmission Control Protocol), ICMP (Internet Control Message Protocol), DNS (Domain Name System), and SNMP (Simple Network Management Protocol).
Additionally, researchers observed that DD4BC exploited a vulnerability in WordPress' pingback function to cause DDOS attacks on various WP websites.
DDOS attacks do not reach extremely high values, generally ranging on average around 13.34 Gbps, with a maximum recorded at 56 Gbps.
The usual methodology of an attack by the DD4BC group is to first send an email in which it is introduced, referencing prior activities, and then demand Bitcoins as ransom from the company.
The ransom usually ranges from 25 to 100 Bitcoin, which is approximately €5.350 – 21.400 euros.
If the extorted companies do not send the ransom, besides launching a DDOS attack, DD4ΒC threatens the company with the public disclosure of information (usually on social media) that can damage the reputation of these companies.
Akamai did not report whether there are companies that ended up paying the ransom, but they said they block at least 75 of the 141 DDOS attacks recorded through their servers.
Since the report only includes data from Akamai's servers, the actual number of DDOS attacks is likely to be many times higher.
