DDoS extortionists target NZX, Moneygram, Braintree, and other financial services

guest · Aug 26, 2020

New Zealand stock exchange hit by cyber attack for second day
Trading halted again, one day after overseas DDoS bombardment that forced stock market to shut down
August 26, 2020
https://www.theguardian.com/technol...k-exchange-hit-by-cyber-attack-for-second-day

New Zealand’s stock market has been interrupted by an apparent overseas cyber attack for the second day running.

The Wellington-based NZX exchange went offline at 11.24am on Wednesday and although some connectivity was restored for investors, some trading was halted.
The NZX said it had experienced “network connectivity issues” and that the NZX main board, NZX debt market and Fonterra shareholders market were placed on halt.

The interruption followed a shutdown and trading halt on Tuesday afternoon due to an overseas-based distributed denial of service (DDoS) attack.
Click to expand...

It said the attack had been “mitigated” and that normal market operations would resume on Wednesday, but this subsequent attack has raised questions about security.
Click to expand...

Reuters: New Zealand's stock exchange hit by second cyber attack

guest · Aug 27, 2020

DDoS downs New Zealand stock exchange for third day
August 27, 2020
https://www.computerweekly.com/news/252488235/DDoS-downs-New-Zealand-Stock-Exchange-for-third-day

New Zealand’s stock exchange has been offline for days after a distributed denial of service (DDoS) attack affected its network connectivity.

On the afternoon of Tuesday 25 August, the stock exchange said it had been hit by a volumetric DDoS attack from offshore via its network service provider, which had impacted network connectivity.
New Zealand’s Exchange (NZX), which operates the market, said in a statement that systems including websites and the markets announcement platform had been hit. At the time, it said the attack was mitigated and connectivity was restored.

NZX expected the market to open the following day, Wednesday 26 August, but it decided to halt trading again after a further disruption.
Click to expand...

“We continue to address the threat and work with cyber security experts, and we are doing everything we can to resume normal trading tomorrow (28 August).”
Cath Goulding, CISO at .uk domain registry Nominet, said the New Zealand attack was very serious and “shows just how much havoc hackers can cause on a national scale, even with attack techniques that are relatively well known”.

“There are suggestions that nation-state hackers are behind this attack,” she added.
Click to expand...

guest · Aug 28, 2020

New Zealand activates security services as DDoS outage enters fourth day
August 28, 2020
https://www.computerweekly.com/news...ity-services-as-DDoS-outage-enters-fourth-day

The New Zealand government has called in its national cyber security services to investigate as the New Zealand Stock Exchange (NZX) remains offline for a fourth day of trading following an unprecedented volumetric distributed denial of service (DDoS) attack that has targeted the organisation through its network service provider.

The Auckland-based exchange had briefly resumed trading on the morning of Friday 28 August, but was again forced to cease trading due to network connectivity issues, and – at the time of writing – the exchange’s website remained inaccessible from a UK IP address.

“I can’t go into much more in terms of specific details, other than to say that we as a government are treating this very seriously. We are aware of the impact that it is having and that is why we have directed the GCSB to help the NZX with this situation,” he said.
Click to expand...

Immuniweb founder and CEO Ilia Kolochenko floated the idea that the attack on NZX may be something of a dress rehearsal for a larger attack against a more prominent target, such as the NASDAQ or London exchanges.

“I don’t think that major cyber gangs have their own interest in, or were hired by someone, to conduct a DDoS capable of repeatedly shutting down NZX [when] even a daily outage of NYSE can lead to multibillion losses around the globe,” he said.
Click to expand...

guest · Aug 29, 2020

NYSE not susceptible to takedown like New Zealand exchange
August 28, 2020
https://www.scmagazine.com/home/sec...ptible-to-takedown-like-new-zealand-exchange/

After a new threat group claiming to be Fancy Bear and the Armada Collective used a DDoS attack to take down the New Zealand stock exchange, security experts say millions of dollars in infrastructure investment make it unlikely that major stock exchanges in New York, London or Hong Kong would suffer a similar take down, though the New Zealand attack could portend a larger attack.

“There’s very little chance a high-frequency trading platform in New York would sustain a DDoS attack, the network is too segmented,” he said. “I still don’t understand why the New Zealand exchange’s trading app got hit, it should be segmented from the public internet.”
“It’s very hard to attack the top exchanges and most hackers go for the low-hanging fruit, said Stephen Manley, chief technologist at Druva.
Click to expand...

In fact, Druva’s Manley said the attack on the New Zealand exchange took about 50,000 device bots at a total cost of roughly $1,500. “People can buy these attacks as-a-service these days,” so for a minimal investment the return can be very high.

As of this morning, no official organization has confirmed the motive was, how much money was lost or if the group Akamai wrote about was actually the group that took down the New Zealand exchange. It’s also been reported the group attacked Venmo, PayPal and Worldpay, among others.
Click to expand...

NYSE is only one of the victims. More:
ZDNet: DDoS extortionists target NZX, Moneygram, Braintree, and other financial services

One of the victims, the New Zealand stock exchange (NZX), has halted trading for the third day in a row following the attacks
Click to expand...

guest · Aug 31, 2020

New Zealand bourse website hit by fresh cyberattack, but keeps trading
August 31, 2020
https://uk.reuters.com/article/us-n...h-cyberattack-but-keeps-trading-idUKKBN25R004

The New Zealand stock market was hit by a fifth day of cyber attacks on Monday, crashing its website, but maintained trading after switching to a contingency plan for the release of market announcements.

NZX Ltd (NZX.NZ) was halted for most of last week due to the attacks, which authorities have said originated offshore.
Monday’s attack came shortly after NZX said it had agreed with the Financial Markets Authority (FMA) on a back-up plan for the release of market announcements.
Click to expand...

The bourse said in a statement that the exchange was working with its network’s service provider, Spark, government cybersecurity agencies, and a U.S.-based cybersecurity firm Akamai Technologies (AKAM.O) to implement additional security measures.

“NZX has been advised by independent cyber specialists that the attacks last week are among the largest, most well-resourced and sophisticated they have ever seen in New Zealand,” NZX’s Chief Executive, Mark Peterson said.
Click to expand...

guest · Sep 2, 2020

New Zealand enduring wave of cyberattacks
September 2, 2020
https://www.nbcnews.com/tech/security/new-zealand-enduring-wave-cyberattacks-rcna105

New Zealand’s justice minister says the nation is confronting cyberattacks on an unprecedented scale, targeting everything from the stock market to the weather service.

Andrew Little said in an interview with The Associated Press on Wednesday that tracking down the perpetrators of the attacks in recent weeks would be extremely difficult, as the distributed denial of service attacks are being routed through thousands of computers.
Little said he’s been told that the sheer volume of data used by the attackers is unprecedented.
Click to expand...

The attacks stopped share trading for up to several hours at a time over four days last week. Private company NZX, which hosts the market, said it halted trading to maintain market integrity because the attacks prevented it from publishing market announcements.

Another bank, Westpac, said it successfully repelled an attack two weeks ago and hadn’t been hit again since. News organizations Stuff and RNZ reported they had repelled attacks over the weekend.
The weather organization MetService was also hit this week, switching its website to a stripped down version in order to stay online.
Click to expand...

Little said the attacks were a wake-up call to all organizations with customer-facing websites. Only a few organizations seem to have been targeted at any one time and most have been able to repel the attacks, giving him confidence the country can move past them.
Click to expand...

guest · Sep 3, 2020

mood said: ↑

NYSE not susceptible to takedown like New Zealand exchange August 28, 2020

NYSE is only one of the victims. More:
ZDNet: DDoS extortionists target NZX, Moneygram, Braintree, and other financial services
Click to expand...

The attackers have been identified as the same hacker group mentioned in an Akamai report published on August 17, last week.
For example, in the case of NZX, the group has repeatedly targeted Spark, the stock exchange's hosting provider, which has also resulted in downtime for the provider's other customers.
Click to expand...

Global DDoS Extorters Demand Ransom from Firms
September 3, 2020
https://www.infosecurity-magazine.com/news/global-ddos-extorters-ransom-notes/

Security experts are warning of a new global DDoS-related extortion campaign targeting businesses operating in the e-commerce, finance and travel sectors.

Radware said it had been tracking the threat actors since mid-August, with victims in North America, APAC and EMEA. Emails are typically delivered claiming to come from state-sponsored groups such as Fancy Bear and Lazarus Group, as well as the “Armada Collective.”
The latter group has been linked to similar extortion emails sent in previous years.
Click to expand...

“In follow-up messages, threat actors underscore that the unique Bitcoin address from the initial letter is still empty and reiterate the seriousness of the threat. They also provide keywords and organization names so the target organization can search for recent DDoS disruptions, followed by the rhetorical question ‘You don't want to be like them, do you?’,” Radware explained.
Click to expand...

Radware Cybersecurity Alert - Global Ransom DDoS Campaign Targeting Finance, Travel and E-Commerce
(PDF): https://mediaserver.responsesource.com/mediabank/18328/AlertRDDoSandISPDDoSAttacksaugust2020.pdf

guest · Sep 3, 2020

FBI: Thousands of orgs targeted by RDoS extortion campaign
September 3, 2020
https://www.bleepingcomputer.com/ne...-of-orgs-targeted-by-rdos-extortion-campaign/

The FBI warns US companies that thousands of organizations around the world, from various industry sectors, have been threatened with DDoS attacks within six days unless they pay a Bitcoin ransom.

The threat actors behind this large and ongoing ransom DDoS (RDDoS or RDoS) campaign that started on August 12, 20220, are posing as well-known hacking groups such as Fancy Bear, Cozy Bear, Lazarus Group, and Armada Collective in the ransom notes delivered to the targeted companies.
In the MU-000132-DD Flash Alert seen by BleepingComputer and distributed to US companies last week, the US domestic intelligence service also adds that the criminal gang is currently targeting organizations from the retail, financial, travel, and e-commerce industry verticals.

While the FBI didn't give any hints on the regions targeted, Israelian cyber-security firm Radware who also issued an alert about these attacks earlier today says that it received attack reports from entities in North America, APAC (Asia-Pacific ), and EMEA (Europe, the Middle East, and Africa).
Click to expand...

US cloud security firm Akamai said in a separate report that the ransom letters are similar to those sent during an RDoS campaign from November 2019, as well as to one from 2017 per the FBI's alert.
Targeted companies advised not to pay the ransom
The FBI recommended US companies that received such ransom notes from the criminal gang behind this ongoing RDoS campaign not to pay the criminals' ransom.
Click to expand...

guest · Oct 14, 2020

Travelex, Other Orgs Face DDoS Threats as Extortion Campaign Rages On
October 14, 2020
https://threatpost.com/travelex-ddos-extortion-campaign/160110/

Companies worldwide have continued to receive extortion emails threatening to launch a distributed denial-of-service (DDoS) attack on their network, unless they pay up – with British foreign-exchange company Travelex reportedly being one recent high-profile threat recipient.

Researchers said that since mid-August, several companies have been sent emails that warn that their company network will be hit by a DDoS attack in about a week. The initial ransom demand is set at 20 BTC – which translates to about $230,000 at the time of writing – and cybercriminals threaten to increase that ransom by 10 BTC for each day not paid, said researchers.

While a high level of activity was first tracked in August, that activity then slowed down in the first half of September – only to “grow significantly” in the end of September and beginning of October, Radware researchers told Threatpost.
Click to expand...

Ongoing DDoS Extortion Threats
While the ransom DDoS campaign has been ongoing since August and has received widespread coverage, researchers with Radware said in a Wednesday post that they are continuing to see companies worldwide receive the extortion emails – and that attackers are becoming more sophisticated.

“There is no way to communicate with the blackmailers, so there is no option to negotiate and the only way to get a message through is by sending BTC to the bitcoin address mentioned in the letter,” researchers said.
The threat actor purports to be various APTs, posing as Fancy Bear, Armada Collective and Lazarus Group. The actors seem to have a preference of APT depending on the vertical they are trying to convince to pay a ransom:
Click to expand...

It’s worth noting that these ransom threats are nothing new. In 2019, cybercriminals posing as Fancy Bear launched DDoS attacks against companies in the financial sector and demanded ransom payments.
Click to expand...

Radware: 2020 Ransom DDoS Campaign Update

Radware and the FBI warned in August about a global ransom DDoS campaign targeting financial institutions and other industries worldwide. Radware has witnessed an increase of new extortion letters from organizations across the globe.
Click to expand...

guest · Dec 5, 2020

NZX will not release report into DDoS attacks, shares summary
December 5, 2020
https://www.reseller.co.nz/article/684968/nzx-will-release-report-into-ddos-attacks-shares-summary/

The NZ Stock Exchange is keeping an independent review of the massive denial of service attacks that took the market down in August under wraps.

InPhySec said the severity of the cyber-attacks went well beyond anything previously seen or that could have been reasonably forecast.

"The volume, sophistication and persistence of the attacks were unprecedented in a New Zealand context, and are amongst the most severe we are aware of to have been experienced internationally,” it said.
The incident also fundamentally changed expectations about this sort of attack for the industry.
Click to expand...

The decision to engage Akamai was also highlighted as being central to the NZX's response to the threats.

"The independent cybersecurity review recommended several technical and process steps to further strengthen security, along with closer communications with the broader cybersecurity community, reviewing risk management processes and ongoing IT consolidation," the NZX said today.
NZX chief executive Mark Peterson welcomed the reviews, saying the key findings were being shared privately with financial market regulators and senior market participants.
Click to expand...

guest · Jan 23, 2021

In second attack DDoS group demands 5 bitcoin payment
January 22, 2021
https://www.scmagazine.com/home/security-news/in-second-attack-ddos-group-demands-5-bitcoin-payment/

Five Radware customers received extortion letters in December and January threatening a DDoS attack if they did not pay five bitcoin (worth about $200,000) from a group that wanted the victims to believe they were from Fancy Bear, Lazarus Group and the Armada Collective.

The threat group first attacked late last summer and in the fall and all the published reports and research points to the group being responsible for well-publicized attacks on the New Zealand Exchange, OTP Bank and Magyar Telecom, among many others. At the time, the FBI issued a warning about a wave of DDoS attacks.

“It’s very unusual that the group attacked a second time,” Geenens said. “We think it could be because the price of bitcoin went up and they were trying to take advantage of the increased value. We have learned that they must have a substantial infrastructure to launch such a large attack and it’s possible they thought that now that they have attacked before, they could reuse the attacks and cash in while the price of bitcoin was still high.”
Click to expand...

Considering that the threat group failed to successfully launch attacks following the initial threats and the ransom costs have nearly tripled because of bitcoin increases, Righi said it’s highly unlikely that the targeted companies will pay the ransom.
Click to expand...

Log in or Sign up

DDoS extortionists target NZX, Moneygram, Braintree, and other financial services

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

DDoS extortionists target NZX, Moneygram, Braintree, and other financial services

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches