Since the threat of leaking stolen documents is not enough in their eyes, some ransomware groups have added denial of service to their arsenal. A Québec City company just learned this the hard way. The Avaddon group recently claimed an attack against this software development company.
It is now customary for attackers to apply what is known as “double extortion.” With this method, the criminals first exfiltrate the data they managed to access. Then they encrypt their victim’s systems. The files are rendered unusable unless the victim pays to obtain the key needed to decrypt them.
Companies with recent and reliable backups are able to recover more quickly from this kind of attack. To increase pressure on victims and force them to pay, the Maze group was the first to threaten to publicly release stolen data. Shortly afterwards, several groups followed suit.
The news site bleepingcomputer.com reported in October 2020 that the SunCrypt and RagnarLocker groups had started adding distributed denial of service (DDoS) to their arsenal.
DDoS is a form of attack where the victim’s server is bombarded with a large number of requests. It is called distributed because the requests come from a multitude of different sources. Unable to handle such a volume of bogus data, the server becomes inaccessible.
The Avaddon group has just joined the list of groups using this method to force their victims to negotiate. On their site, one can see a list of companies affected by a denial of service.
On the morning of April 27, the Québec City company’s website was indeed inaccessible. When contacted, the company preferred not to comment on the events. The entrepreneur, who asked us to keep him anonymous, told us that “there is no clear guide on the role of IT security as an SME is being built” and that although investing in security may seem like a significant expense, especially at the beginning, “a risk assessment should lead to the conclusion that such expenses are smaller than the potential damage.”
It remains to be seen whether other groups will now start practising this “triple extortion.”
cover photo credit: Ben Elwood - CC BY-NC license
