September 8, 2022
Unknown attackers disrupt the activities of former members of the Conti ransomware gang by flooding their Cobalt Strike servers with DDoS attacks displaying anti-Russian messages.
The unknown attackers are tracking the TeamServers (C2) used by ransomware actors to control the Cobalt Strike (C2) Beacon payloads on compromised hosts (clients). Attackers flood the CS servers and use the username “Stop Putin!” on several computers and change their computer names to various messages such as “Stop the war,” “15000+ dead Russian soldiers!” and “Be a Russian patriot!”
Vitali Kremez, CEO of cyber intelligence firm Advanced Intelligence, said the attacks initially targeted at least four Cobalt Strike servers that were allegedly controlled by ex-Conti members.
He also explained that the messages flood the servers at a high rate of about two per second, which led to an overload of the Java application of Cobalt Strike TeamServer. The unknown attackers constantly target Cobalt Strike servers, which are believed to be operated by former Conti ransomware members, and therefore continue the flood as soon as a new server is discovered.
A similar DDoS attack was carried out on LockBit after the ransomware gang leaked data from Entrust.
The sources for this piece include an article in BleepingComputer.
