Police target DDoS cyber criminal group in international operation

The Austrian police have arrested one person and detained a second in an international operation against the cyber criminal group DD4BC (DDoS for Bitcoin). As its name suggests, the group uses distributed denial of service (DDoS) attacks to target organisations for extortion. Austria initiated Operation Pleiades with support from Europol’s European Cybercriminal Centre (EC3) and the Joint Cybercrime Action Taskforce (J-CAT). Working alongside them were police forces from Bosnia and Herzegovina, Germany and the UK, which additionally co-ordinated with the police in Australia, France, Japan, Romania, Switzerland, and the US. Beginning in July 2014, the group initially targeted the online gambling industry before broadening its operations to include the entertainment industry, financial services, the oil and gas sector, and the technology sector. Europol has warned businesses against paying ransoms when targeted by groups like DD4BC, arguing that those that do are often targeted again. Instead, the agency called on organisations to invest in mitigation capability, which help to both protect them and increase costs for the attacker.

Police have arrested one person and detained another in a co-ordinated international operation aimed at the cyber criminal gang calling itself DD4BC (DDoS for bitcoin).

Since July 2014, the gang has been using distributed denial of service (DDoS) attacks – or at least the threat of DDoS attacks – to extort money from a range of organisations.

In the December 2015 operation, police forces from the UK, Bosnia and Herzegovina, Austria and Germany joined forces with Europol.

Key members of DD4BC were identified in Bosnia and Herzegovina by the UK Metropolitan Police Cyber Crime Unit (MPCCU).

Police authorities from Australia, France, Japan, Romania, the US, Switzerland and Interpol supported the co-ordinated activities.

Operation Pleiades included searches of various properties. Europol said an extensive amount of evidence was seized.

The operation, initiated by Austria, was supported by Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce (J-CAT).

Operational meetings were organised in The Hague to discuss and plan co-ordinated law enforcement actions against DD4BC.

During the operation, Europol deployed a mobile office, allowing direct access to Europol’s forensic tools and its databases for cross-checking, analysing and exchanging intelligence in real time.

Europol said DDoS attacks remain a considerable threat in the European Union (EU) and beyond, and this type of extortion has become a well-established criminal enterprise affecting thousands of victims globally.

Europol believes the number of unreported incidents is high, noting that the absence of reporting by private companies and individuals hampers law enforcement’s efforts to prosecute threats.

DD4BC initially targeted the online gambling industry, but broadened its activities to include the financial services, oil and gas, entertainment and technology sectors.

In May 2015, Swiss computer emergency response team, GovCert, said several high-profile organisations in Switzerland had been targeted by DD4BC, while Cert-UK confirmed it was monitoring DD4BC’s activities and had issued an advisory through the government’s cyber security information sharing partnership (CISP).