CybSec Group Members Convicted Over DDoS Extortion Attacks on AnastasiaDate
Summary
AnastasiaDate suffered DDoS extortion attacks in 2015 and 2016. Group-IB and Qrator Labs helped identify two Ukrainian perpetrators, who pleaded guilty and received suspended sentences in 2018.
Key points
- In September 2015, a DDoS attack repeatedly took AnastasiaDate offline for four to six hours a day; attackers demanded 50 BTC, then worth about $11,800.
- The extortionists used email, Skype, payment credentials, and hacking-forum accounts to promote DDoS services and coordinate their activities.
- Group-IB analyzed server logs and other digital traces; Qrator Labs supported DDoS protection efforts.
- The investigation linked the group to attacks on other organizations, including Stafford Associated and PayOnline, with typical ransom demands of $1,000 to $10,000.
- AnastasiaDate faced another DDoS extortion campaign in November 2016, which investigators connected to the same suspects.
- Ukrainian authorities arrested two suspects; both pleaded guilty and received five-year suspended sentences in January 2018.
Article Details
- Victim Organization
- AnastasiaDate
- Incident Type
- Distributed denial-of-service (DDoS) attacks accompanied by extortion demands
- Operational Impact
- In September 2015, the website was inaccessible for several days, with outages lasting 4 to 6 hours each day. A further DDoS extortion attack affected the website in November 2016.
- Ransom Or Extortion
- The attackers demanded 50 BTC, reported as approximately $11,800 at the time, to stop the 2015 attacks. A separate account says the extortionists demanded $10,000. In November 2016, the site received another ransom demand and a threat to resume attacks; the threat was followed by DDoS attacks. The article does not state the amount demanded in 2016.
- Claim Status
- confirmed
MITRE ATT&CK
People
Threat Actors
CybSec GroupCybercriminal group described as conducting DDoS attacks and extortion against international companies; the article says the group was identified and its members convicted.Gayk G.Identified by Group-IB as one of the organizers of the extortion attacks against AnastasiaDate in 2015 and 2016; the article says he pleaded guilty and was convicted.Inna Y.Identified by Group-IB as an organizer of the extortion attacks against AnastasiaDate in 2015 and 2016 and as the alleged head of the larger group; the article says she pleaded guilty and was convicted.
Vendors
Group-IBGroup-IB played a major role in identifying members of a cybercriminal group called CybSec Group, which was engaged in extortion and distributed denial-of-service (DDoS) attacks on international companies between 2015Qrator LabsAdditionally, in addressing the challenge of preventing DDoS attacks, the company enlisted the support of Qrator Labs.