A pro-Russian group has created a crowdsourced project called “DDOSIA” that pays volunteers to launch distributed denial-of-service (DDOS) attacks against Western entities.
See also: Pro-Russian group KillNet carries out DDoS attacks on US airport websites
DDoS attacks typically have no security implications for the target, but they can cause significant damage by causing downtime. Depending on the target, the impact can extend beyond financial losses.
Because DDoS attacks are easy to organize and simple to execute, they were the de facto weapon of hacktivists on both sides of the Russian-Ukrainian war.
Introducing a financial incentive is a new strategy, say researchers at cybersecurity firm Radware in a report shared with BleepingComputer.
In hacktivist DDoS attacks, volunteers do not receive monetary compensation. Joining the cause is usually what they want. With the added financial incentive, DDOSIA attracts attackers who do not necessarily support the cause.
See also: DDoS attack on Overwatch 2 video game servers
DDOSIA Operators
Project DDOSIA was launched in mid-August by a group called “NoName057(16)” that had emerged in March 2022. The group was first publicly documented in a report by cybersecurity firm Avast in early September.
Avast highlighted the presence of a DDoS module downloaded from 'Bobik' – a remote access trojan (RAT) discovered in 2020 and dropped by information stealer RedLine.
After three months of monitoring, between June and September, Avast concluded that the NoName057(16) group had been conducting DDoS attacks on Ukrainian organizations but was only successful in 40% of its attacks.
See also: LockBit ransomware: Triple extortion tactic – DDoS attacks are also coming
DDOSIA started on Telegram, where the operators shared a link to a GitHub page containing instructions for prospective volunteers. The channel now has over 13,000 members.
Throughout its existence, DDOSIA aligned itself with the goals set by the pro-Russian KillNet gang and contributed to the recent wave of DDoS attacks against major airports in the United States.
Pay for DDoS power
Volunteers for DDOSIA must register via Telegram to receive a ZIP file with the malware (“dosia.exe”), which contains a unique identifier for each user.
Members can link this ID to a cryptocurrency wallet and receive money for participating in DDoS attacks, with the payment being proportional to the power they provide.
The top contributors in each attack wave receive 80,000 rubles ($1,250), second-place attackers receive 50,000 rubles ($800), and third-place participants are compensated with 20,000 rubles ($300).
Currently, the DDOSIA project has about 400 members, regularly targeting a list of 60 military and educational organizations in Ukraine.
The financial reward is an attractive incentive and could allow NoName057(16) to not only attract a mass of volunteers but also create a trend for other DDoS groups.
Information source: bleepingcomputer.com
