U.S., Germany and Canada Disrupt Four Major DDoS Botnets
Summary
Authorities in the U.S., Germany and Canada targeted infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets. The DOJ says the botnets had infected more than three million IoT devices.
Key points
- The joint operation targeted virtual servers, domains and other command-and-control infrastructure used by the four botnets.
- The Justice Department said the operation aims to prevent further infections and limit the botnets’ ability to launch attacks.
- Court documents allege the botnets issued more than 200,000 Aisuru, 25,000 KimWolf, 90,000 JackSkid and 1,000 Mossad DDoS attack commands.
- The DOJ says the botnets infected more than three million IoT devices, including webcams, DVRs and Wi-Fi routers.
- Aisuru reportedly launched a DDoS attack peaking at 31.4 Tbps and 200 million requests per second against telecom targets.
- Operators sold botnet access to other criminals; the article says some attacks involved extortion demands and caused losses and remediation costs.
Article Details
- Event Type
- International law enforcement disruption of command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets.
- Impact
- Authorities in the United States, Germany, and Canada targeted virtual servers, domains, and other infrastructure to prevent further IoT device infections and botnet attacks. The U.S. Justice Department says the botnets collectively infected more than three million devices and court documents allege they issued hundreds of thousands of DDoS attack commands. Attacks caused service degradation and financial and remediation costs; victims included telecom targets and the Department of Defense Information Network.
MITRE ATT&CK
Malware
AisuruU.S., German, and Canadian authorities dismantled command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets that had infected millions of IoT devices and launched hundreds of thousandsJackskidand Canadian authorities dismantled command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets that had infected millions of IoT devices and launched hundreds of thousands of DDoSKimwolfU.S., German, and Canadian authorities dismantled command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets that had infected millions of IoT devices and launched hundreds of thousandsMossadauthorities dismantled command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets that had infected millions of IoT devices and launched hundreds of thousands of DDoS attacks.
Vendors
Akamaioverwhelm high-capacity cloud-based mitigation services,” said cybersecurity and cloud computing company Akamai, which was one of the private sector firms involved in the joint action.MicrosoftAisuru was also behind a previous DDoS record of 29.7 Tbps, while an incident originating from 500,000 IP addresses(which Microsoft attributed to the same botnet) peaked at 15.72 Tbps in November.
Countries
CanadaAuthorities from the United States, Germany, and Canada have taken down Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things (IoT) devices.GermanyAuthorities from the United States, Germany, and Canada have taken down Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things (IoT) devices.United StatesU.S., German, and Canadian authorities dismantled command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets that had infected millions of IoT devices and launched hundreds of thousands