Extorting money from companies under the threat of launching distributed denial-of-service attacks (DDoS) against their online properties has proven lucrative for cybercriminals. So much so that one group has managed to earn over $100,000 without any evidence that it’s even capable of mounting attacks.
Since early March, hundreds of businesses have received threatening emails from a group calling itself the Armada Collective, asking to be paid between 10 and 50 bitcoins — $4,600 to $23,000 — as a "protection fee" or face DDoS attacks exceeding 1Tbps. [ Security expert Cricket Liu lays out the workings of a DNS-based DDoS attack — and how to prevent one from hitting your company. Download the PDF today! | Stay up to date on the latest security developments with InfoWorld’s Security newsletter . ] While many of them did not comply, some did; the group’s bitcoin wallet address shows incoming payments of over $100,000 in total. Yet none of the companies who declined to pay the protection fee were attacked, website protection firm CloudFlare found.
The company talked with more than 100 current and prospective customers who received an extortion email from the Armada Collective, as well as with other DDoS mitigation providers whose customers have been threatened by the group.
"Our conclusion was a bit of a surprise: we’ve been unable to find a single incident where the current incarnation of the Armada Collective has actually launched a DDoS attack," said Matthew Prince, the CEO of CloudFlare, in a blog post . "In fact, because the extortion emails reuse Bitcoin addresses, there’s no way the Armada Collective can tell who has paid and who has not."
The conclusion is that whoever is behind the latest Armada Collective DDoS threats is just reusing the name of a previous group that did attack companies last year, but whose […]
