Threat Actor Deploys Raven Storm Tool to Perform DDoS Attacks

guest · Sep 3, 2022

By Alessandro Mascellino @a_mascellino - August 22, 2022

The threat actor dubbed 'Mysterious Team' has used the Raven Storm tool to conduct distributed denial-of-service (DDoS) attacks against multiple targets.

The news comes from CloudSEK, who detailed the new threat in an advisory on Sunday.

“[Our] contextual AI digital risk platform XVigil discovered a post by the Mysterious Team announcing the use of the Raven Storm tool DDoS attacks,” reads the document. “The tool uses multi-threading for sending multiple packets at a single moment of time and getting the target down.”
Additionally, the malware is reportedly capable of server takedown, Wi-Fi attacks and application layer attacks. It also gives attackers the ability to connect to a client via botnets.
From a technical standpoint, Raven Storm attacks layers 3 (network), 4 (transport), and 5 (application) of the application layer.
Click to expand...

The malware is coded in Python, uses a CLIF framework to operate, and can efficiently deal with robust servers. It also works at a user level (not requiring any ‘sudo,' ‘su,' or root permissions), which makes it particularly dangerous.

At the same time, CloudSEK said its security researchers believe Raven Storm requires multiple instances like botnets to operate successfully.
Click to expand...

In terms of how the attack is executed, Raven Storm requires a URL to be provided to the attacker, who will use it to connect it to the botnet. The attacker would then execute the command “server” and define a custom password for using this botnet, thus preventing others from interfering.

“The attack begins once the user enters the required code [...] and the target host (IP address),” reads the advisory. “A request is sent to the target host to see if it is responsive; if it is, the attack is launched.”
Click to expand...

CloudSEK: Raven Storm, the Multi-Threading Tool Employed by Hacktivists for DDoS Attacks

THREAT

• Mysterious Team advertising a powerful multi-threading DDoS tool capable of server takedown, wifi attack, and application layer attacks.
• Tool also allows connecting to a client via botnets.
IMPACT

• Significant downtime for the targeted website and server
• Loss of brand reputation.
• Hosting issues for other websites being hosted on the same server.
Click to expand...

MITIGATION

• Implement anti-DDoS protection on the server.
• Use IP geo-blocking in case of an attack.
Click to expand...

Log in or Sign up

Threat Actor Deploys Raven Storm Tool to Perform DDoS Attacks

guest Guest

Log in or Sign up

Threat Actor Deploys Raven Storm Tool to Perform DDoS Attacks

guest Guest

Useful Searches