Hackers claim to be renting a massive Mirai botnet with more than 400,000 infected bots, ready to carry out DDoS attacks.
For readers who are not familiar with Mirai, we inform you that it is a type of malware that targets Internet-connected devices (IoT – Internet of Things) and was used about two months ago in one of the largest DDoS attacks known to date.
Its victims include French Internet service provider OVH (1.1 Tbps), provider Dyn (unknown size) and even the personal blog of investigative journalist Brian Krebs (620 Gbps), who at the time had exposed an Israeli DDoS for hire service called VDOs.
In some promotional spam messages sent via XMPP/Jabber yesterday, the two hackers advertise their own DDoS for hire service, built on the Mirai malware. They claim to be in control of a Mirai botnet consisting of 400,000 devices.
The two hackers behind this botnet are named BestBuy and Popopret, and they are the same two hackers who were behind the GovRAT malware that was used to breach and steal data from countless US companies. They are also the core of a group of hackers who operated on the infamous Hell hacking forum, considered the main meeting place for many elite hackers. More details about their past efforts are available in the InfoArmor report published this fall.
According to the botnet's advertising and what hacker Popopret has leaked in his chats, customers can rent a desired quantity of Mirai bots, but for a minimum period of two weeks.
The price is determined by the amount of bots (more bots more money), the duration of the attack (more money), and the cooldown time (more time = discount).
Customers do not get a discount if they purchase larger quantities of bots, but they are given a discount if they use long cooldown periods.
As for the rental price, hacker Popopret gave an order of magnitude for where it ranges: “the price for 50,000 bots with an attack duration of 3600 seconds (1 hour) and 5-10 minutes of rest time is about 3-4k per 2 weeks.” Obviously he means 3-4,000 dollars and as you can see, it is not a cheap service.
Once the botnet owners reach an agreement with the buyer, the customer receives an onion URL of the botnet's backend, where they can connect via Telnet and launch their attacks.
