Armada Collective Copycats Made $100,000 Only from Empty DDoS Threats

[baziroll]

Copycats imitating the Armada Collective hacking group have made well over $100,000 (€90,000) from empty DDoS threats against companies all over the world.
Armada Collective is believed to be the alternative name of DD4BC, a group of crooks that surfaced last year. DD4BC operated by contacting companies via email and threatening to launch DDoS attacks if they didn't pay a Bitcoin ransom.
The group was active up until last September when Akamai exposed them. At the same time, a new group called Armada Collective arose, using the same tactic, which was active until late November - early December.
About the same time, Europol had also started an investigation. At the start of January, they arrested key suspects in Bosnia and Herzegovina, and activity from the group died down.
The new group is only a copycat
As CloudFlare revealed yesterday, ever since March, someone has been using the Armada Collective name in ransom emails threatening to launch DDoS attacks.
CloudFlare says that companies that didn't pay never faced any DDoS attacks afterwards. DD4BC and Armada Collective always kept their word, and when a company didn't pay, they came back with DDoS attacks reaching peak values of 60 Gbps. This led CloudFare to deduce that this group is nothing more than a cheap copycat.
The coypcat group operates by sending ransom notes via email, where they are quick to point the user to search their name on Google, in order to see their "capabilities," "reputation," and "fame."
Additionally, the group is only using one Bitcoin wallet address to receive payments. Since Bitcoin is an anonymous digital currency, this means that if a company paid, the group would have never known which one did.
Armada Collective copycats made a fortune by doing nothing
The group made a fortune just by sending empty threats via email. A copy of the group's extortion email can be read below. After analyzing the group's Bitcoin wallet address history, Bitcoin analysis firm Chainalysis says the copycats received over $100,000 (€90,000)-worth of Bitcoin.
A typical email has no fixed ransom sum, and the group randomly asks for sums between 10 and 50 Bitcoin ($4,500 - $23,400). The sums have no correlation with the company's size and financial resources.
CloudFlare says it was alerted by the copycat's actions after more than 100 companies contacted them inquiring about their DDoS protection service. CloudFlare says that they, and other DDoS protection services, have never observed any attacks against the companies that received any such notes.
The most recent case of an Armada Collective ransom demand comes from the BlackVPN service, which received one last week. Additionally, the Cloak VPN service also received a similar threat, but it never attributed it to Armada Collective. Curiously, these services experienced downtimes from DDoS attacks, unlike CloudFlare's report, so it may seem that more than one copycat group is active on the market.

source

[Me2today]

Good stuff