A new DDoS-as-a-Service platform called Passion was recently used by pro-Russian hacktivists to launch attacks against medical institutions in the United States and Europe. A DDoS attack is when malicious actors send a large number of requests and garbage traffic to a target server in order to overwhelm it and prevent it from responding to legitimate requests. DDoSaaS platforms rent out their available firepower to those looking to launch disruptive attacks, eliminating the need to build their own large botnets or coordinate volunteer action. These botnets are usually created by exploiting vulnerable IoT devices such as routers and IP cameras, uniting them into a large swarm that generates malicious requests towards a particular target. Radware discovered the Passion platform, and although its origins are unknown, it has clear ties to Russian hacking groups such as Killnet, MIRAI, Venom, and Anonymous Russia. The Passion Botnet was used in the attacks on January 27th, targeting medical institutions in the USA, Portugal, Spain, Germany, Poland, Finland, Norway, Netherlands, and the United Kingdom as retaliation for sending tanks in support of Ukraine, according to Radware researchers. The operators of the Passion DDoS platform first advertised their service at the beginning of January 2023, performing several defacements on Japanese and South African organization sites. The service operates as a subscription, where customers can purchase desired attack vectors, duration, and intensity. Passion offers the option of ten attack vectors, allowing subscribers to customize their attack as needed and even combine vectors to bypass mitigations implemented by the target. As for the cost of the service, a seven-day subscription costs $30, a month costs $120, while a full year sets back threat actors $1,440. Accepted payment methods include Bitcoin, Tether, and the Russian payment service QIWI. Passion uses the Dstat. Cc measurement service to showcase its L4 and L7 attack capabilities and effectiveness against DDoS mitigation providers like CloudFlare and Google Shield. In October 2022, a pro-Russian DDoS crowdsourcing project named DDOSIA was launched, paying volunteers who took part in attacks and awarding significant amounts to those with the highest contributed firepower. Passion is added to an already flourishing DDoS ecosystem, increasing the problem for organizations worldwide that are the recipients of these attacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 01 Feb 2023 17:58:02 +0000