Fancy Lazarus is Active with Ransom DDoS Attacks

What's new?

• Most of the targeted organizations in the recent attacks are found to be operating in multiple sectors such as energy, insurance, financial, public utilities, retail, and manufacturing.
• The group is demanding a starting ransom of 2 BTC (at present evaluated at $75,000) to avoid a DDoS attack.
• The extortion price doubles to 4 BTC after the specific deadline and increases by 1BTC every single day after that. In addition, most of these targets are found to be based in the U.S.
• It’s hard to make a definitive connection, however, the timing of Fancy Lazarus campaigns is similar to high-profile ransomware attacks that happened in the past six months in the same industries.

The RDDoS attack

• The extortion emails are sent in plain text, HTML-based, or a letter in a JPG image, likely to avoid detection. Additionally, such emails are often sent to the help desk, administrative contacts, or customer service.
• These emails are sent to well-researched recipients, who are listed as contacts in BGP, Whois information, or working in external relations, communications, and investor relations domains.

Conclusion