DDoS Extortion: How to Respond
Some attackers threaten DDoS unless paid. Here is how to handle ransom demands.
Ransom DDoS (RDoS) campaigns involve attackers threatening to launch — or continue — attacks unless the victim pays, usually in cryptocurrency. Messages often include a short demonstration attack to appear credible.
Don't panic
Many extortion messages are bluffs or reuse threats sent to many organisations. Some attackers lack the capacity they claim.
Don't pay
Payment does not guarantee attacks will stop and marks your organisation as willing to pay, inviting future demands.
Inform your provider immediately
Share the message with your connectivity and security providers. They can increase monitoring, enable always-on mitigation and prepare for attacks.
Verify protection coverage
Confirm that all public IP addresses, websites and critical services are protected.
Preserve evidence
Keep the original messages, headers and any attack logs for investigation.
Report to authorities
Report extortion attempts to the appropriate cybercrime authorities and CERT-In, as required.
Prepare communication
Inform leadership and prepare customer messages in case attacks cause disruption.
Watch for distractions
Attacks may be used to distract from intrusion attempts. Monitor other systems closely.
Review afterwards
Whether or not attacks occur, review your readiness and update plans.
The bottom line
Don't pay — prepare. With proper protection and a calm response, ransom DDoS threats can be handled effectively.
Learn more about DDoS Business Protect from UbiFi, or talk to our team.
Always-on DDoS detection and mitigation that keeps your websites, portals and VPNs online during attacks.
