Radware Alert

Fancy Lazarus DDoS Extortion Group is Back with New Campaign Focused on Unprotected Assets Across All Industries

Radware Onboards Numerous Customers with Fancy Lazarus Ransom Letters in Recent Weeks

MAHWAH, N.J., June 14, 2021 (GLOBE NEWSWIRE) -- Radware (NASDAQ: RDWR), a leading provider of cyber security and application delivery solutions, published a cybersecurity alert warning that Fancy Lazarus, a well-known distributed denial of service (DDoS) extortionist, has resurfaced with a new campaign focused on organizations with unprotected assets across all sizes of companies in all industries.

Less than a year ago, a Ransom DDoS threat actor posing as “Fancy Bear" and "Lazarus Group” was targeting specific industries such as finance, travel and e-commerce organizations and was blind to whether these organizations had DDoS protection or not. This earlier campaign turned out to be one of the most extensive and longest-running DDoS extortion campaigns in history.

Lately, Radware has identified an increase in emergency onboardings from new customers that have had DDoS ransomware threats. In recent weeks, Radware has been monitoring an increase of activity from a threat actor calling himself Fancy Lazarus targeting organizations with assets that were supposedly not adequately protected and inviting them to pay a ransom rather than endure devastating DDoS attacks.

In their letters, the extortionists give their victims seven days to buy the Bitcoin and pay the ransom before they start their DDoS attacks. Each day after the deadline passes without payment increases that fee. The ransom demand varies between targets and seems to be adjusted to a target’s reputation and size. The ransom demand is also less expansive compared to the huge demands of 10 and 20 Bitcoin (currently, about $370,000 and $740,000 at time of writing) witnessed from last summer’s campaigns. Demands now generally vary between 0.5 Bitcoin ($18,500) and five Bitcoin ($185,000) and increase by the same amounts for every day the deadline is missed.

“This is the first time we are seeing the bad actors selectively target organizations and favor those with unprotected assets for their ransom letters,” said Pascal Geenens, Director of Threat Intelligence, Radware. “This implies that malicious actors are leveraging Border Gateway Protocol routing information to detect whether targets are protected by always-on cloud protection services. In addition, we’re seeing that ransom DDoS, which traditionally was an event limited in time with yearly spikes, is now becoming a persistent threat, and should be considered an integral part of the DDoS threat landscape.”