Cobalt strike server of ransomware gang disrupted by DDoS Attacks

Unknown attackers disrupt the activities of former members of the Conti ransomware gang by flooding their Cobalt Strike servers with DDoS attacks displaying anti-Russian messages.

The unknown attackers are tracking the TeamServers (C2) used by ransomware actors to control the Cobalt Strike (C2) Beacon payloads on compromised hosts (clients). Attackers flood the CS servers and use the username “Stop Putin!” on several computers and change their computer names to various messages such as “Stop the war,” “15000+ dead Russian soldiers!” and “Be a Russian patriot!”

Vitali Kremez, CEO of cyber intelligence firm Advanced Intelligence, said the attacks initially targeted at least four Cobalt Strike servers that were allegedly controlled by ex-Conti members.

He also explained that the messages flood the servers at a high rate of about two per second, which led to an overload of the Java application of Cobalt Strike TeamServer. The unknown attackers constantly target Cobalt Strike servers, which are believed to be operated by former Conti ransomware members, and therefore continue the flood as soon as a new server is discovered.

A similar DDoS attack was carried out on LockBit after the ransomware gang leaked data from Entrust.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web