Multiple ransomware data leak sites experience DDoS attacks, facing intermittent outages and connectivity issues
Summary: In late August, Cisco Talos observed suspected DDoS attacks against the Tor-hosted data leak sites of ransomware operations including ALPHV/BlackCat and LockBit, and on Aug. 26 at least seven more RaaS leak sites - LV, Hive, Everest, BianLian, Yanluowang, Snatch and Lorenz - became intermittently inaccessible or slow. LockBit representative LockBitSupp reported on Aug. 20 that nearly 1,000 servers were targeting the sites at nearly 400 requests per second, calling it the worst DDoS attack in three years, while ALPHV publicly denied being DDoSed.
Why it matters: Talos notes the disruption hit only the leak sites, not the ransomware operations themselves - victim interactions and payments could still take place - so the visible outage is not a sign the extortion stopped. LockBit responded by announcing DDoS as a third extortion tactic alongside encryption and leaking, a technique few ransomware groups use that Talos says could aid recruitment.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·