SANS ISC: Emails threatening DDoS allegedly from Phantom Squad

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Introduction

As a follow-up to one of our June 2017 diaries asking people to forward us any DDoS threats, we received yet another example: 

Details

Since 2017-09-19, at least 4 people have tweeted about the same type of emails, supposedly from Phantom Squad:

• https://twitter.com/TProphet/status/910199852524478464
• https://twitter.com/willfull/status/910504944729559040
• https://twitter.com/drowningbynums/status/910774194803224581
• https://twitter.com/trbrink/status/910211259655704577

This feels like a scam using the notariety of Phantom Squad's name, because the group has gotten some fairly high-profile press coverage in recent years.  In December 2015, Phantom Squad claimed responsibility for a DDoS attack against Xbox Live.  A year later in December 2016, Phantom Squad was apparently involved in a DDoS attack against Steam.  However, I haven't found any evidence yet this group is involved in small business extortion.

Wheter or not this email is legitimate or fake, they all use notariety of the group's name to make the threat sound plausible.

In our June 2017 diary about fake DDoS extortion emails, Johannes Ullrich provides some guidance for people that receive these types of messages.  Tips include:

• Verify your DDoS plan:  Do you have an agreement with an anti-DDoS provider?  A contact at your ISP?  If so, make sure everything is set up and working right.

• Attackers often run short tests before launching a DDoS attack.  Can you find any evidence of that?  Has there been a brief, unexplained traffic spike?  If so, take a closer look.  The threat is more serious if you detect an actual test, because the purpose of a test is often to assess the firepower needed to DDoS your network.

Final words

Thanks to everyone who already forwarded examples to us.  As Johannes previously asked in June 2017, please continue to forward us any similar emails.  We can always use the additional data.

A santized copy of our most current example can be found here.  It's in a password-protected zip archive.  If you don't know the password, look here.

---
Brad Duncan
brad [at] malware-traffic-analysis.net