The HelloKitty ransomware group, best known for breaching and stealing data from video game developer CD Projekt Red, has added distributed denial-of-service (DDoS) attacks to its arsenal of extortion tactics.
Extortion Techniques Press Victims for Time
The FBI first detected HelloKitty in January 2021. The gang has made a name for itself by breaching and encrypting the video game developer. In addition, it stole the source code for several of the company’s games.
According to the FBI, the HelloKitty ransomware group tailors each ransom demand to its victims based upon their ability to pay. In the event victims don’t respond quickly enough or don’t pay the ransom, HelloKitty posts their data. They use the Babuk gang website to do this, or sell the data to a third-party broker.
They started using DDoS in November, reported Bleeping Computer. To be specific, the HelloKitty group used a Linux variant to target VMware’s ESXi virtual machine platform.
How Ransomware Extortion Has Changed
This tactic, known as double extortion, first emerged in 2019. With it, ransomware groups exfiltrate victims’ information in plaintext before encrypting their data. That way, the attackers can demand two ransoms. One will be in exchange for a decrypter. The other will be to confirm the attackers have deleted the stolen data from their servers.
Some also use triple extortion directing more ransom demands at a victim’s clients and suppliers. It may also involve extorting employees and customers, or targeting business partners with spear-phishing attacks.
Researchers may also refer to quadruple extortion. In this case, ransomware groups like HelloKitty use DDoS attacks as a means of putting pressure on their victims. Or, in quintuple extortion, some newer ransomware variants like Yanluowang tell their victims to not contact law enforcement agencies or ransomware negotiators. They threaten to target non-compliant victims with DDoS attacks. They can also go after their business partners, as well as repeat the attack in a few weeks’ time and delete their data outright.
Defending Against DDoS-Powered Ransomware Gangs
HelloKitty’s use of DDoS attacks for extortion underscores the need for businesses and agencies to defend themselves against ransomware.
One of the ways they can do that is by using a solution to monitor data usage and access patterns. Such a tool can help spot ransomware gangs disguising themselves as privileged users and/or attempting to execute large data pulls.
Second, businesses can turn to an eXtended Detection and Response (XDR) platform as a means of streamlining threat detection and response across their entire infrastructure. Such a tool can help your people detect and respond more quickly. Thereby, it will help mitigate the impact of digital threats such as ransomware attacks.
Finally, use threat intelligence to defend against emerging ransomware attacks. Then, add that threat intelligence into security awareness training programs to educate employees about new ransomware threats.