The HelloKitty ransomware group, best known for breaching and stealing data from video game developer CD Projekt Red, has added distributed denial-of-service (DDoS) attacks to its arsenal of extortion tactics.

Extortion Techniques Press Victims for Time

The FBI first detected HelloKitty in January 2021. The gang has made a name for itself by breaching and encrypting the video game developer. In addition, it stole the source code for several of the company’s games.

According to the FBI, the HelloKitty ransomware group tailors each ransom demand to its victims based upon their ability to pay. In the event victims don’t respond quickly enough or don’t pay the ransom, HelloKitty posts their data. They use the Babuk gang website to do this, or sell the data to a third-party broker.

They started using DDoS in November, reported Bleeping Computer. To be specific, the HelloKitty group used a Linux variant to target VMware’s ESXi virtual machine platform.

How Ransomware Extortion Has Changed

This tactic, known as double extortion, first emerged in 2019. With it, ransomware groups exfiltrate victims’ information in plaintext before encrypting their data. That way, the attackers can demand two ransoms. One will be in exchange for a decrypter. The other will be to confirm the attackers have deleted the stolen data from their servers.

Some also use triple extortion directing more ransom demands at a victim’s clients and suppliers. It may also involve extorting employees and customers, or targeting business partners with spear-phishing attacks.

Researchers may also refer to quadruple extortion. In this case, ransomware groups like HelloKitty use DDoS attacks as a means of putting pressure on their victims. Or, in quintuple extortion,  some newer ransomware variants like Yanluowang tell their victims to not contact law enforcement agencies or ransomware negotiators. They threaten to target non-compliant victims with DDoS attacks. They can also go after their business partners, as well as repeat the attack in a few weeks’ time and delete their data outright.

Defending Against DDoS-Powered Ransomware Gangs

HelloKitty’s use of DDoS attacks for extortion underscores the need for businesses and agencies to defend themselves against ransomware.

One of the ways they can do that is by using a solution to monitor data usage and access patterns. Such a tool can help spot ransomware gangs disguising themselves as privileged users and/or attempting to execute large data pulls.

Second, businesses can turn to an eXtended Detection and Response (XDR) platform as a means of streamlining threat detection and response across their entire infrastructure. Such a tool can help your people detect and respond more quickly. Thereby, it will help mitigate the impact of digital threats such as ransomware attacks.

Finally, use threat intelligence to defend against emerging ransomware attacks. Then, add that threat intelligence into security awareness training programs to educate employees about new ransomware threats.

More from News

HHS Releases Hospital Cyber Resiliency Landscape Analysis

4 min read - On April 17, 2023, The U.S. Department of Health and Human Services (HHS) 405(d) Program announced the release of its Hospital Cyber Resiliency Initiative Landscape Analysis. This landmark analysis reports on domestic hospitals’ current state of cybersecurity preparedness. The scope of the HHS study was limited to activities that protect access to patient care and safety and reduce the negative impact of cyber threats on clinical operations. Breaches of sensitive data were considered only if the breach had a direct…

4 min read

Zombie APIs are a Top Security Concern as API Attacks Surge 400%

4 min read - Organizations of all sizes rely on application programming interfaces (APIs). The API explosion has been driven by several factors, including cloud computing, demand for mobile/web applications, microservices architecture and the API economy as a business model. APIs enable developers to access data remotely, integrate with other services, build modular applications and monetize their data/services. For enterprises that participated in a recent research study, the average number of APIs per organization was 15,564. Large enterprises (over 10,000 employees) had an average…

4 min read

Google’s Bug Bounty Hits $12 Million: What About the Risks?

4 min read - Bug bounty numbers have never been better. In 2022, Google rewarded the efforts of over 700 researchers from 68 different countries who helped improve the security of the company’s products and services. The total amount of awards grew from $8.7 million paid in 2021 to $12 million in 2022, a nearly 38% increase. Over the past few years, bug bounty programs have gained significant traction. Companies have been lured in by the potential to identify vulnerabilities quickly, enhance product security…

4 min read

Swiss Army Knife Malware Slices Through Systems In so Many Ways

4 min read - What if one single malware strain could cut through any security that tried to stop it? In a new study of more than 550,000 live malware strains, the Picus Red Report 2023 has unveiled a trove of over 5 million malicious activities. In the report, researchers identified the top tactics utilized by cyber criminals in 2022. Picus' findings also highlighted the growing prevalence of "Swiss Army knife malware". This type of malicious software is capable of executing a range of…

4 min read