Someone is using the 'Cozy Bear' moniker to scare DDoS victims into bitcoin payments

It looks like scammers are impersonating one of Russia’s most notorious hacking groups in order to extort victims out of thousands of dollars worth of bitcoin.

It looks like scammers are impersonating one of Russia’s most notorious hacking groups in order to extort victims out of thousands of dollars worth of bitcoin.

Multiple companies have reported to the security vendor Akamai that they were hit with a distributed denial-of-service attack, which degrades victims’ web services by overwhelming them with fake traffic. After a brief DDoS hit, victims say they receive an extortion note from a group claiming to be Cozy Bear, a state-sponsored Russian hacking group.

The scheme works like this: attackers launch the DDoS attack from a botnet, in which each IP in the botnet sends a fraction of the overall traffic to the target. The victim has a deadline, typically six days, to pay two bitcoin. If they don’t pay by the time the deadline expires, the fee increases by one bitcoin per day, and the DDoS resumes.

Cozy Bear is best known for deploying customized malware in quiet, sustained attacks meant to gather intelligence on behalf of the Kremlin. The group is best known for its role in the hack of the Democratic National Committee prior to the 2016 U.S. presidential election. Cozy Bear has also targeted U.S. think tanks, defense contractors and ministries of foreign affairs in at least three European countries, according to findings made public in October by the antivirus firm ESET.

“What they’re not known for, though, are extortion campaigns,” Akamai said in its latest alert. “As such, Akamai believes the letter is from a copycat group leveraging the Cozy Bear name as a means to invoke fear and panic. Their extortion letter actually suggests victims perform a Google search on their name, which immediately returns results related to the infamous group.

Akamai did not speculate on the identities of the scammers behind the copycat effort.

This crime spree comes after a U.S. judge sentenced a 21-year-old man to 13 months in prison for running services that made it possible for attackers to launch millions of their own DDoS attacks with little fear of being apprehended. Sergiy Usatyuk, of Illinois, also was ordered to forfeit $542,925 earned as part of his DDoS-for-hire scheme, which hit a Pittsburgh school district, the county government and a Catholic Diocese in the area, according to the Department of Justice.

Officials seize 53 DDoS-for-hire domains in ongoing crackdown

Operation PowerOFF’s latest globally coordinated action identified more than 75,000 alleged cybercriminals. Officials warned each of them to stop jamming up traffic.

Officials gain control of Rapper Bot DDoS botnet, charge lead developer and administrator

Pro-Russian DDoS group NoName057(16) disrupted by international law enforcement operation

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems