An unknown hacking group is demanding astronomical amounts of Bitcoins under the name Armada Collective. Cybercrime syndicates seem to be taking action, putting script kiddies out of the game…
In the wake of the successful actions of powerful DDoSing groups, such as DD4BC and Armada Collective ,a mysterious hacking operating under the name Armada Collective, demanding astronomical amounts from its victims, has emerged.
A recent report by cybersecurity firm Recorded Future shows that the “ DDoS–For–Bitcoin ” extortion tactic is here to stay, with more and more hackers employing similar methods when carrying out attacks.
This trend is described in detail in a report released by Akamai a few months ago, presenting and documenting the actions of the hacking DD4BC (DDoS 4 Bitcoin). The group began carrying out DDoS on companies around the world, demanding small payments in Bitcoins.
[alert variation=”alert-success”]The DD4BC methodology was simple. The hackers sent threatening emails to business owners, warning them that they would launch powerful DDoS attacks if the required ransom in Bitcoins was not paid on time. To demonstrate their capabilities, the hackers even carried out short-term DDoS attacks to further intimidate the victims.[/alert]
The DD4BC system has proven to be extremely profitable, as they have managed to carry out more than 140 successful DDoS attacks in the past year, extorting ransoms in bitcoins from their victims. The group had been active since late 2014, but after the Akamai it suddenly ceased its activity in order to avoid detection by law enforcement authorities.
In a short time, a new group with related activities emerged, carrying out DDoS on small businesses in Switzerland.
Signing as Armada Collective , the fledgling group gradually expanded its activities, carrying out attacks on encrypted email providers , including ProtonMail, Zoho, Hushmail, FastMail, Neomailbox, VFEmail, and Runbox.
The Armada Collective became widely known after the attack on ProtonMail, a service used by researchers at the European scientific center for nuclear research CERN. The company was forced to pay 20 bitcoins, but even after paying the ransom, the threats did not stop.
It was then that a second group of hackers found fertile ground – prepared by the Armada Collective – to break into ProtonMail and cause problems in its infrastructure. Armada Collective was quick to distance itself from this second attack and returned part of the ransom to ProtonMail, blaming the attack on “state-sponsored hackers with capabilities beyond their own.”
The ProtoMail incident prompted Recorded Future security researchers to consider the bigger picture of the attack. The researchers' indications of the existence of a powerful hacking group, which exploits the Armada Collective name, demanding astronomical amounts of bitcoins, began to be confirmed after the recent attacks on three major systemic banks in our country, by hackers who also signed as Armada Collective.
“With DD4BC and Armada Collective always carrying out small-scale attacks and demanding small amounts of money as ransom, this new group that attacked ProtonMail and Greek banks does not fit the profile of the aforementioned DDoSing groups,” the researchers say. “While the attacks by DD4BC and Armada Collective appear to be the work of script kiddies , the attacks targeting ProtonMail and the three major Greek banks were massive in scale,” they add .
Combined with the fact that this new mysterious group is demanding a ransom of hundreds of thousands of dollars, there are clear indications that this is a group that is trying to remain hidden, taking advantage of the Armada Collective name, something that has not yet been officially confirmed.
With the number of “DDoS-for-Bitcoin” attacks constantly on the rise, the only certainty is that this type of cyberthreat is ready to evolve from the work of script kiddies, into a powerful weapon in the hands of experienced hackers and join the circle of activities of the largest cybercrime syndicates.
