December 9, 2021 By David Bisson 2 min read

The HelloKitty ransomware group, best known for breaching and stealing data from video game developer CD Projekt Red, has added distributed denial-of-service (DDoS) attacks to its arsenal of extortion tactics.

Extortion Techniques Press Victims for Time

The FBI first detected HelloKitty in January 2021. The gang has made a name for itself by breaching and encrypting the video game developer. In addition, it stole the source code for several of the company’s games.

According to the FBI, the HelloKitty ransomware group tailors each ransom demand to its victims based upon their ability to pay. In the event victims don’t respond quickly enough or don’t pay the ransom, HelloKitty posts their data. They use the Babuk gang website to do this, or sell the data to a third-party broker.

They started using DDoS in November, reported Bleeping Computer. To be specific, the HelloKitty group used a Linux variant to target VMware’s ESXi virtual machine platform.

How Ransomware Extortion Has Changed

This tactic, known as double extortion, first emerged in 2019. With it, ransomware groups exfiltrate victims’ information in plaintext before encrypting their data. That way, the attackers can demand two ransoms. One will be in exchange for a decrypter. The other will be to confirm the attackers have deleted the stolen data from their servers.

Some also use triple extortion directing more ransom demands at a victim’s clients and suppliers. It may also involve extorting employees and customers, or targeting business partners with spear-phishing attacks.

Researchers may also refer to quadruple extortion. In this case, ransomware groups like HelloKitty use DDoS attacks as a means of putting pressure on their victims. Or, in quintuple extortion,  some newer ransomware variants like Yanluowang tell their victims to not contact law enforcement agencies or ransomware negotiators. They threaten to target non-compliant victims with DDoS attacks. They can also go after their business partners, as well as repeat the attack in a few weeks’ time and delete their data outright.

Defending Against DDoS-Powered Ransomware Gangs

HelloKitty’s use of DDoS attacks for extortion underscores the need for businesses and agencies to defend themselves against ransomware.

One of the ways they can do that is by using a solution to monitor data usage and access patterns. Such a tool can help spot ransomware gangs disguising themselves as privileged users and/or attempting to execute large data pulls.

Second, businesses can turn to an eXtended Detection and Response (XDR) platform as a means of streamlining threat detection and response across their entire infrastructure. Such a tool can help your people detect and respond more quickly. Thereby, it will help mitigate the impact of digital threats such as ransomware attacks.

Finally, use threat intelligence to defend against emerging ransomware attacks. Then, add that threat intelligence into security awareness training programs to educate employees about new ransomware threats.

More from News

CISA adds Microsoft SharePoint vulnerability to the KEV Catalog

3 min read - In late October, the United States Cybersecurity & Infrastructure Security Agency (CISA) added a new threat to its Known Exploited Vulnerability (KEV) Catalog. Cyber criminals used remote code execution vulnerability in Microsoft SharePoint to gain access to organizations’ networks. The CISA press release states that “these types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.” However, Microsoft identified and released a patch for this vulnerability in July 2024. Cybersecurity experts…

Research finds 56% increase in active ransomware groups

4 min read - Any good news is welcomed when evaluating cyber crime trends year-over-year. Over the last two years, IBM’s Threat Index Reports have provided some minor reprieve in this area by showing a gradual decline in the prevalence of ransomware attacks — now accounting for only 17% of all cybersecurity incidents compared to 21% in 2021. Unfortunately, it’s too early to know if this trendline will continue. A recent report released by Searchlight Cyber shows that there has been a 56% increase in…

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today