-The Armada Collective is a Distributed Denial of Service Extortion Group that is currently unattributed

-This group of malicious actors utilize tactics similar to those used by the group DD4BC (Ddos for Bit Coin)

-Actors email potential targets and threaten a DDoS unless a ransom is paid.

-Initially suspected to be DD4BC resuming attacks under a new name; but now appears more likely that this is a copycat group

-This group claims to have the ability to unleash a DDoS attack of more than 1 Tbps per second. (Note: the biggest Armada Collective attack mitigated to date has only peaked at 772 Mbs)

-To date, the Armada Collective is known to have targeted:
-Australian Organizations
-Other International Organizations
-Japanese, Swiss and Thai financial institutions
-ProtonMail
-Hushmail
-Runbox

Armada Collective Tactics, Techniques and Procedures (TTPs) include:
-Conduct limited DDos attacks against organizations
-Send Ransom emails following the initial attack(s)
-Threaten another, longer, DDos attack will occur if an extortion payment is not made by the victim
-Initial extortion email has different senders and subjects:
-”A little taste”
-”Ransom request: DDoS Attack”
-”Last Warning”
-Maximum observed traffic throughput reported to be approximately 50 Gbps
-Traffic predominately originated from source ports 1900/UDP and NTP
-DDoS attacks have used UDP reflection and amplification

Share this: