The Fancy Lazarus Group's DDoS Extortion Attacks: A Growing Threat to Global Organizations

The Fancy Lazarus Group, a notorious cybercriminal organization, has been making headlines in recent months for its widespread DDoS extortion attacks. These attacks are characterized by the attacker initiating a demonstration DDoS attack against select elements of the targeted organization's online services and application delivery infrastructure, followed by an emailed extortion demand for payment via Bitcoin cryptocurrency.

The targets of these attacks have been diverse, including broadband access ISPs, healthcare providers, insurance providers, personal care product manufacturers, regional energy providers, and IT-related vendors. However, starting in mid-August 2020, the Fancy Lazarus Group shifted its focus to a global campaign of DDoS extortion attacks, primarily targeting regional financial and travel-industry organizations such as regional banks, stock exchanges, travel agencies, currency exchanges, and their upstream internet transit providers.

The most recent development in these attacks is the inclusion of public-facing website contact forms in the extortion demands. This allows recipients to share information about the attack without restriction, subject only to standard copyright rules. The Fancy Lazarus Group has also been observed using memcached reflection/amplification as an additional attack vector.

In response to the growing threat posed by the Fancy Lazarus Group, organizations are advised to take immediate action to protect themselves against these types of attacks. This includes implementing robust DDoS mitigation strategies, such as traffic scrubbing and content delivery networks (CDNs), as well as maintaining regular backups and monitoring network activity for signs of suspicious behavior.

Furthermore, it is essential for organizations to stay vigilant and proactive in responding to the Fancy Lazarus Group's extortion demands. Failing to respond to these demands can result in a second round of attacks, which can have devastating consequences for an organization's online presence and reputation.

In conclusion, the Fancy Lazarus Group's DDoS extortion attacks are a growing threat that requires immediate attention and action from organizations worldwide. By understanding the tactics and techniques used by this group, organizations can better prepare themselves to mitigate these types of attacks and protect their online infrastructure from harm.

Fancy lazarus group