December 9, 2021 By David Bisson 2 min read

The HelloKitty ransomware group, best known for breaching and stealing data from video game developer CD Projekt Red, has added distributed denial-of-service (DDoS) attacks to its arsenal of extortion tactics.

Extortion Techniques Press Victims for Time

The FBI first detected HelloKitty in January 2021. The gang has made a name for itself by breaching and encrypting the video game developer. In addition, it stole the source code for several of the company’s games.

According to the FBI, the HelloKitty ransomware group tailors each ransom demand to its victims based upon their ability to pay. In the event victims don’t respond quickly enough or don’t pay the ransom, HelloKitty posts their data. They use the Babuk gang website to do this, or sell the data to a third-party broker.

They started using DDoS in November, reported Bleeping Computer. To be specific, the HelloKitty group used a Linux variant to target VMware’s ESXi virtual machine platform.

How Ransomware Extortion Has Changed

This tactic, known as double extortion, first emerged in 2019. With it, ransomware groups exfiltrate victims’ information in plaintext before encrypting their data. That way, the attackers can demand two ransoms. One will be in exchange for a decrypter. The other will be to confirm the attackers have deleted the stolen data from their servers.

Some also use triple extortion directing more ransom demands at a victim’s clients and suppliers. It may also involve extorting employees and customers, or targeting business partners with spear-phishing attacks.

Researchers may also refer to quadruple extortion. In this case, ransomware groups like HelloKitty use DDoS attacks as a means of putting pressure on their victims. Or, in quintuple extortion,  some newer ransomware variants like Yanluowang tell their victims to not contact law enforcement agencies or ransomware negotiators. They threaten to target non-compliant victims with DDoS attacks. They can also go after their business partners, as well as repeat the attack in a few weeks’ time and delete their data outright.

Defending Against DDoS-Powered Ransomware Gangs

HelloKitty’s use of DDoS attacks for extortion underscores the need for businesses and agencies to defend themselves against ransomware.

One of the ways they can do that is by using a solution to monitor data usage and access patterns. Such a tool can help spot ransomware gangs disguising themselves as privileged users and/or attempting to execute large data pulls.

Second, businesses can turn to an eXtended Detection and Response (XDR) platform as a means of streamlining threat detection and response across their entire infrastructure. Such a tool can help your people detect and respond more quickly. Thereby, it will help mitigate the impact of digital threats such as ransomware attacks.

Finally, use threat intelligence to defend against emerging ransomware attacks. Then, add that threat intelligence into security awareness training programs to educate employees about new ransomware threats.

More from News

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

State Department releases International Cyberspace and Digital Policy Strategy

3 min read - U.S. Secretary of State Antony Blinken announced the new U.S. International Cyberspace and Digital Policy Strategy during the recent RSA Conference in San Francisco. The strategy emphasizes the role of technology in diplomacy and the urgent need to build international coalitions. “Security, stability, prosperity — they are no longer solely analog matters,” Blinken said at the conference. The new strategy focuses on “digital solidarity” not “digital sovereignty,” Blinken said, emphasizing the importance of collaboration with like-minded nations. Also mentioned was…

DHS establishes Artificial Intelligence Safety and Security Board

3 min read - As part of its commitment to addressing the rapid growth and adoption of AI technology across all industries and sectors, the Department of Homeland Security (DHS) announced the establishment of the Artificial Intelligence Safety and Security Board in late April. The Board’s first meeting is planned for early May when they will begin the task of focusing on how to develop and deploy AI technology within the United States’ critical infrastructure safely and securely. Based on the DHS Homeland Threat…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today