#Vendetta online plug ins code#
#Vendetta online plug ins series#

#Vendetta online plug ins code#

The attacker used code from a github project to launch the floods. Signature 5: SST-DESTROYERĭuring the 29 and 30th of January 2022, two more waves of attacks were launched against Rappler. The fake website was announced three weeks later in Facebook (7th of December) by Pinoy Vendetta. The fake website was announced by Pinoy Vendetta.

The website was hidden inside ( Website hidden in Github. During the middle of November 2021, Pinoy Vendetta developed a website with the domain intending to impersonate CPP-NPA (Communist Party of the Philippines–New People’s Army) and NDFP (National Democratic Front of the Philippines). Signature 4: A Fake WebsiteĭDoS was not the only technique used by the group. The attack lasted for 3 hours and flooded the website with a peak traffic of 1 Million requests per second. A new attack vector was present in this new wave, the attacker targeted the xmlrpc.php of the WordPress website in order to bypass the Cache of the site. The attack included the same signatures that previous attacks with the presence of SEO domains in the referrers of the floods. The top 20 IP addresses of the botnet accounted for 50% of the requests. At 8 AM, the botnet peaked 1 Million requests per second. The 23rd of December attacks against Rappler was claimed by Pinoy Vendetta to been carried out by “Abdul”.Īn analysis of 400 GB of compressed logs of the attack against Rapper showed around 2,000 IP addresses that launched a Denial of Service against the website. The attacks were claimed by “ Abdul” from “ Pinoy Vendetta“.

#Vendetta online plug ins series#

List of “spam referrer” domainsĪ new series of Denial of Services against Rappler took place the 23rd of December 2021. The majority of these domains were already present in the Matomo list. The majority of the IP addresses were open proxies in USA, China, Germany, Indonesia, Russia and Vietnam.Īfter reviewing close to 38,000 log files with 8TB of data from, we extracted more than 2,500 “spam referrer” domains. In the attack against Rappler, we identified close to 14,000 IP addresses flooding the website. In this case, the attacker targeted the Article “ Journalists Maria Ressa, Dmitry Muratov receive Nobel Peace Prize“ hxxp://ressa-muratov-receive-nobel-peace-prize Reviewing 8 TB of attack data

The patterns reproduce the DAVOSET functionality. Qurium also compared the attack patterns against 250,000 events recorded by the Web Application Firewall (WAF) of ABS-CBN recorded the 11th of December 2021 (2:00-4:00 UTC). the botnet used for both attacks was the same). On December 17, Qurium compared a sample of 2.5 million attack log lines ( 10:11 – 10:40 AM UTC) against Rappler with digital forensics information from the attack against Verafiles, and could quickly conclude that the attack infrastructure was common for both attacks (i.e. The analysis of traffic logs from the attacks, leaked a few malformed botnet commands - POST .txt- POST - POST .txtDAVOSET source code (floods via other websites functionality) Linking all attacks DAVOSET includes a list of websites that can be abused to bounce web requests towards the victims. The attacks contained signatures that suggested the use of DAVOSET, a tool used to abuse other websites to make them the source of the attack. CCAttack Generated Query Strings + Spam Referral Floods Signature 3: Use of DAVOSET Execution Tool This pattern has been present in other attacks against Philippine targets, such as the attack against Karapatan, described in the report “ Human rights alliance ‘Karapatan’ under long lasting DDoS attack”.īoth GET and HEAD methods were used in the attacks.

Qurium could classify the pattern as sourced from Challenge Collapsar python code. The floods also contained query strings following the pattern: CHAR + INT + CHAR + INT + CHAR + CHAR + INT + CHAR + INT + CHAR

Botnet programmer just obtained a random list of referrers for its tool.

Botnet programmer can take advantage of Denial of Service attacks to amplify its SEO strategy.

It is unclear why those specific referrers where used in the attack, but our qualified guesses are: The community of Matomo Analytics (an open source web analytics platform) has been collecting many of these domains and a list can be found here. More information about Spam Bombing can be found here. The botnet uses several thousands of domains classified as “referrer spam” in the floods. Six attack signatures are listed and explained in this report, in order to help other victims to detect and mitigate future attacks. The attacks against the sites had some distinctive signatures.

Signature 3: Use of DAVOSET Execution Tool.