There is a current extortion campaign that seems particularly focused in the UK. The threat is to deliver a DDoS attack together with ransomware infections if the victim does not pay a ransom in bitcoins. The ransom starts relatively low at just 1 bitcoin, but increases to 20 bitcoins if not paid within a certain time. The attackers claim to be the Armada Collective.
A new report published today is supported by a blog post claiming, “Nettitude, has identified a coordinated DDoS extortion and ransomware campaign, which has been targeting financial institutions over the past few days. Senior managers at the affected organisations received emails purporting to be from the Armada Collective, threatening DDoS attacks and demanding Bitcoin payments.”
The report itself opens, “For the last few days, senior managers at various financial institutions such as banks have received an email from a group purporting to be the Armada Collective.” However, there is no further information on the institutions concerned, nor any real evidence to suggest that the attackers actually are the Armada Collective.
Nevertheless, there is or has been an extortion campaign in recent weeks most likely operated by Armada copycats. Nettitude references an incident reported by German language publication Trojane-Info on Sept. 1: “In the name of ‘Armada Collective’ several financial institutions [in Germany] have received in the past week blackmailer emails. The threat of copycat is real in contrast to many other copycats because the gunmen launched an attack warning of 90 Gbps.” (Google translation).
This makes the distinction between copycats who carry out their threat and others that do not — and this is a problem for those who receive the extortion emails. If the attacker is genuinely the Armada Collective then the threat is possibly serious; otherwise it can be ignored.
The International Business Times reported Sept. 5 on two examples of similar emails received by UK individuals. Again the attackers claim to be the Armada Collective, with the emails claiming, “We are a HACKER TEAM – Armada Collective”.
The threat is the same as the email quoted by Nettitude: pay one bitcoin or be subject to a serious DDoS attack followed by Cerber ransomware infection. IBTimes adds, “However, it is impossible to tell if the cybercriminals behind this new email demand are the real group, or simply cybercriminals taking advantage of the real group’s infamy.”
Apart from the campaign against financial institutions, Nettitude has detected two further ‘extortion campaigns against UK-based companies’. Here the emails are identical, but the ransom destination bitcoin wallet has been changed. “This finding indicates that the threat actors are employing a scattergun approach with the hope that one of the victims responds to the extortion attempt.”
However, it also provides a strong indication that the email is more of a scam than a threat. When a user is infected by ransomware, the malware will generate a unique bitcoin wallet. This way, when the victim pays the ransom, the attacker knows exactly who has paid. If a single wallet is used for multiple targets, then the attacker cannot tell which victim paid which ransom. In other words it is more likely to be a simple fear-based scam.
In an April analysis of the ‘Armada’ threat, CloudFlare concluded, “Our conclusion was a bit of a surprise: we’ve been unable to find a single incident where the current incarnation of the Armada Collective has actually launched a DDoS attack. In fact, because the extortion emails reuse Bitcoin addresses, there’s no way the Armada Collective can tell who has paid and who has not. In spite of that, the cybercrooks have collected hundreds of thousands of dollars in extortion payments.”
As independent security blogger Graham Cluley comments, “I think all businesses should be mindful of the potential for empty threats and copycat attacks before they rush to pay any wannabe extortionist.”
Related: DD4BC, Armada Collective Inspire Cyber Extortion Copycats