Pro-Russian Hacktivists Target Organizations in Austria With DDoS Attack Campaign

2024年9月20日下午08:23

Threat groups launch a five-day—and counting—politically motivated cyberattack campaign that includes government sites, airports and the Vienna Stock Exchange.

Download now

Threat groups launch a five-day—and counting—politically motivated cyberattack campaign that includes government sites, airports and the Vienna Stock Exchange.

概览

• Pro-Russian threat actors NoName057(16) and OverFlame have launched a series of DDoS attacks on Austrian targets.
• The attacks are presumably connected to the Russian-Ukrainian conflict, although NoName057 claims they “decided to visit Austria again to check on cybersecurity ahead of the upcoming elections.”
• The attack campaign started on September 16 and continues against over 40 targets including government sites, airports, financial services and Wiener Borse.

Motivation

According to a NoName057 Telegram message, motivation is associated with the upcoming Austrian elections: “On September 29, Austrian citizens will elect members of the 28th National Council, the lower house of the country's parliament. According to polls, the far-right Freedom Party of Austria (FPÖ) is expected to lead with 27 percent of the vote and form the largest faction in parliament. In second place, the opposition Social Democratic Party of Austria (SPÖ) is projected to come in with 23% of voter support. In third place is likely to be the Austrian People's Party (ÖVP) with 22% support, which is part of the current ruling coalition. We decided to visit Austria again to check on cybersecurity ahead of the upcoming elections. As it turns out, nothing has changed since our last visit."

Threat Actors

NoName057(16) is a pro-Russian hacker group known for its cyberattacks on Ukrainian, American and European websites of government agencies, media and private companies. It is regarded as a well-organized hacktivist group with over 2.5 years of experience targeting countries that support Ukraine or speak badly about Russia.

OverFlame is a relatively obscure hacktivist group known for targeting government institutions and corporations, particularly in Europe and North America. The group specializes in DDoS attacks and website defacements, often motivated by anti-government and anti-corporate sentiments. OverFlame operates through underground forums and encrypted messaging platforms, where they coordinate their attacks and recruit new members.

It is common to see like-minded threat actors make ad-hoc alliances and collaborate on campaigns to increase their impact.

Attack Tools

Threat actors have mastered their ability to generate highly evasive and sophisticated HTTPS flood attacks that are hard to detect and mitigate.

The tool used by NoName057, the major threat actor in this campaign, is a crowdsourced botnet project named DDOSIA. The project leverages politically driven hacktivists willing to download and install a bot on their computers to launch denial-of-service attacks. Project DDOSIA, however, raises the stakes by providing financial incentives for the top contributors to successful denial-of-service attacks.

Figure 2: NoName057 claims an HTTPS flood attack on the Wiener Boerse AG managing the stock exchange in Vienna and Prague. The Check Host page shows the victim resources were offline

Attack Timeline

Claiming Actors

Targeted Industries

EFFECTIVE DDOS PROTECTION ESSENTIALS

EFFECTIVE WEB APPLICATION SECURITY ESSENTIALS

威胁警报

Want to read the complete threat alert?

Download it for free right now.