Russian banks continue to face onslaught of DDoS attacks

Since Tuesday, five Russian banks have been targeted in an ongoing attack. The campaign does not look to be caused by the Mirai botnet.

Hackers armed with botnets are launching an expansive and coordinated distributed denial of service campaign against a group of prominent Russian banks this week, security researchers tell CyberScoop. The attacks began on Tuesday and have continued since then.

Moscow-based Kaspersky, one of the world’s largest cybersecurity firms, are closely monitoring the events unfolding this week from the ground. More than five banks have been affected.

“Criminals often target financial institutions. The purpose may be different: black mail, or smoke screen to cover other attacks, or hacktivism,” said Kaspersky DDoS Prevention Group Manager Alexander Khalimonenko, “[so] we don’t know what the purpose of this campaign is.”

The attack began Nov. 8 at 4 p.m. MSK and it is still in progress. The longest attack within this campaign lasted for 12 hours. And the biggest single DDoS blast so far peaked at about 660,000 requests per second.

Roughly 24,000 computers located across 30 different countries were involved in the attack on the Russian banks. More than 50 percent of the infected computers are distributed between the U.S., India, Taiwan and Israel, Khalimonenko said.

A DDoS attack is powered by a network of infected, internet-connected devices that then send artificially-created access requests to a target domain. A flood of access requests can cause a website to crash or have its services disrupted.

“According to what we see, a Mirai-controlled botnet is not used in these attacks,” said Khalimonenko.

Conflicting, prior news reports have suggested that at least one of the botnets used to disrupt services in Russia included compromised smart devices like security cameras and internet-connected home appliances. But Khalimonenko said those stories are incorrect.

“We registered a first attack early [Tuesday] in the morning,” a representative from Russia’s Sberbank told RIA Novosti, “the next attack in the evening involved several waves, each of them was twice as powerful as the previous one. Bank’s cybersecurity noticed and located the attack in time. There have been no problems in client online services.”

It appears some of the affected banks — most of whom have yet to be publicly named — did not receive the same level of focus from the attackers.

Officials seize 53 DDoS-for-hire domains in ongoing crackdown

Operation PowerOFF’s latest globally coordinated action identified more than 75,000 alleged cybercriminals. Officials warned each of them to stop jamming up traffic.

Officials gain control of Rapper Bot DDoS botnet, charge lead developer and administrator

Pro-Russian DDoS group NoName057(16) disrupted by international law enforcement operation

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure