Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

“Armada Collective” DDoS Threats Strike Again

There is a current extortion campaign that seems particularly focused in the UK. The threat is to deliver a DDoS attack together with ransomware infections if the victim does not pay a ransom in bitcoins. The ransom starts relatively low at just 1 bitcoin, but increases to 20 bitcoins if not paid within a certain time. The attackers claim to be the Armada Collective.

There is a current extortion campaign that seems particularly focused in the UK. The threat is to deliver a DDoS attack together with ransomware infections if the victim does not pay a ransom in bitcoins. The ransom starts relatively low at just 1 bitcoin, but increases to 20 bitcoins if not paid within a certain time. The attackers claim to be the Armada Collective.

A new report published today is supported by a blog post claiming, “Nettitude, has identified a coordinated DDoS extortion and ransomware campaign, which has been targeting financial institutions over the past few days. Senior managers at the affected organisations received emails purporting to be from the Armada Collective, threatening DDoS attacks and demanding Bitcoin payments.”

The report itself opens, “For the last few days, senior managers at various financial institutions such as banks have received an email from a group purporting to be the Armada Collective.” However, there is no further information on the institutions concerned, nor any real evidence to suggest that the attackers actually are the Armada Collective.

Nevertheless, there is or has been an extortion campaign in recent weeks most likely operated by Armada copycats. Nettitude references an incident reported by German language publication Trojane-Info on Sept. 1: “In the name of ‘Armada Collective’ several financial institutions [in Germany] have received in the past week blackmailer emails. The threat of copycat is real in contrast to many other copycats because the gunmen launched an attack warning of 90 Gbps.” (Google translation).

This makes the distinction between copycats who carry out their threat and others that do not — and this is a problem for those who receive the extortion emails. If the attacker is genuinely the Armada Collective then the threat is possibly serious; otherwise it can be ignored. 

The International Business Times reported Sept. 5 on two examples of similar emails received by UK individuals. Again the attackers claim to be the Armada Collective, with the emails claiming, “We are a HACKER TEAM – Armada Collective”.

The threat is the same as the email quoted by Nettitude: pay one bitcoin or be subject to a serious DDoS attack followed by Cerber ransomware infection. IBTimes adds, “However, it is impossible to tell if the cybercriminals behind this new email demand are the real group, or simply cybercriminals taking advantage of the real group’s infamy.”

Apart from the campaign against financial institutions, Nettitude has detected two further ‘extortion campaigns against UK-based companies’. Here the emails are identical, but the ransom destination bitcoin wallet has been changed. “This finding indicates that the threat actors are employing a scattergun approach with the hope that one of the victims responds to the extortion attempt.”

Advertisement. Scroll to continue reading.

However, it also provides a strong indication that the email is more of a scam than a threat. When a user is infected by ransomware, the malware will generate a unique bitcoin wallet. This way, when the victim pays the ransom, the attacker knows exactly who has paid. If a single wallet is used for multiple targets, then the attacker cannot tell which victim paid which ransom. In other words it is more likely to be a simple fear-based scam.

In an April analysis of the ‘Armada’ threat, CloudFlare concluded, “Our conclusion was a bit of a surprise: we’ve been unable to find a single incident where the current incarnation of the Armada Collective has actually launched a DDoS attack. In fact, because the extortion emails reuse Bitcoin addresses, there’s no way the Armada Collective can tell who has paid and who has not. In spite of that, the cybercrooks have collected hundreds of thousands of dollars in extortion payments.”

As independent security blogger Graham Cluley comments, “I think all businesses should be mindful of the potential for empty threats and copycat attacks before they rush to pay any wannabe extortionist.”

Related: DD4BC, Armada Collective Inspire Cyber Extortion Copycats

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.