2023年7月4日,

Jul 04 2023 Ravie LakshmananMalware / Cyber Attack The 威胁 背后 的 演员 DDoSia 攻击 工具 想出 了 一 个 新 版本 , 其中 包括 一 个 新的 机制 来 获取 目标 的 列表 与 垃圾 HTTP 轰炸 下来 试图 把 他们 的 请求更新的变体,写在Golang”,实现了一个额外的安全机制来隐藏目标的列表,这是传播(指挥)的用户,“网络安全公司称Sekoia技术帐面价值。DDoSia归因于亲俄罗斯的黑客组织“无名(057)16。在2022年推出的继任者Bobik僵尸网络,攻击工具是专为分期分布式拒绝服务(DDoS)攻击目标主要位于欧洲和澳大利亚,加拿大和日本。立陶宛、乌克兰、波兰、意大利、Czechia、丹麦、拉脱维亚、法国、英国和瑞士已成为最针对性的国家在一段时间内从5月8日到6月26日,2023年。总共有486个不同的网站受到影响。Python和Go-based DDoSia已经出土的实现,使之成为一个跨平台的程序能够被用于Windows, Linux和macOS系统。“DDoSia是一个多线程应用程序,进行拒绝服务攻击目标网站通过不断发行网络请求,“SentinelOne解释分析发表在2023年1月。由配置文件“DDoSia问题请求指示,恶意软件从C2服务器接收时开始。” DDoSia is distributed through a fully-automated process on Telegram that allows individuals to register for the crowdsourced initiative in exchange for a cryptocurrency payment and a ZIP archive containing the attack toolkit. What's noteworthy about the new version is the use of encryption to mask the list of targets to be attacked, indicating that the tool is being actively maintained by the operators. "NoName057(16) is making efforts to make their malware compatible with multiple operating systems, almost certainly reflecting their intent to make their malware available to a large number of users, resulting in the targeting of a broader set of victims," Sekoia said. The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of targeted denial-of-service (DoS) and DDoS attacks against multiple organizations in multiple sectors. "These attacks can cost an organization time and money and may impose reputational costs while resources and services are inaccessible," the agency said in a bulletin. Although CISA did not provide any additional specifics, the warning overlaps with claims by Anonymous Sudan on its Telegram channel that it had taken down the websites of the Department of Commerce, Social Security Administration (SSA), and the Treasury Department's Electronic Federal Tax Payment System (EFTPS). Anonymous Sudan attracted attention last month for carrying Layer 7 DDoS attacks against various Microsoft services, including OneDrive, Outlook, and Azure web portals. The tech giant is tracking the cluster under the name Storm-1359. The hacking crew has asserted it's conducting cyber strikes out of Africa on behalf of oppressed Muslims across the world. But cybersecurity researchers believe it to be a pro-Kremlin operation with no ties to Sudan and a member of the KillNet hacktivist collective. In an analysis released on June 19, 2023, Australian cybersecurity vendor CyberCX characterized the entity as a "smokescreen for Russian interests." The company's website has since become inaccessible, greeting visitors with a "403 Forbidden" message. The threat actor claimed responsibility for the cyber attack. "The reason for the attack: stop spreading rumors about us, and you must tell the truth and stop the investigations that we call the investigations of a dog," Anonymous Sudan said in a message posted on June 22, 2023. Anonymous Sudan, in a Bloomberg report last week, further denied it was connected to Russia but acknowledged they share similar interests, and that it goes after "everything that is hostile to Islam." CISA's latest advisory has also not gone unnoticed, for the group posted a response on June 30, 2023, stating: "A small Sudanese group with limited capabilities forced 'the most powerful government' in the world to publish articles and tweets about our attacks." Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post. SHARE    