‘Russian hacktivists’ claim responsibility for DDoSing German airport websites

February 17, 2023 TH Author

A series of distributed denial-of-service (DDoS) attacks shut down seven German airports’ websites on Thursday, a day after a major IT glitch at Lufthansa grounded flights.

Ralph Beisel, the general manager of Germany’s ADV airport association, confirmed the network-flooding events in an emailed statement to The Register, but did not specify which airports were hit.

“Again today the airports fell victim to large-scale DDoS attacks,” Beisel said, adding that the DDoS flood rendered the seven airports’ websites temporarily unavailable. “As far as we know, other systems are not affected. It is unclear to what extent the situation will spread to other locations. The airport association ADV is currently preparing a situation report.”

Airports in Düsseldorf, Hanover, Dortmund, Erfurt, Nuremberg and Baden-Baden were affected by the bot-traffic tsunami, according to Spiegel, which reported that a “Russian hacktivist group” took credit for the attacks. The outages only lasted about an hour.

Larger airports in Frankfurt, Munich and Berlin were reportedly unaffected.

The DDoS attacks follow a series of IT incidents affecting Germany’s aviation industry over the last few weeks.

On Wednesday, Lufthansa Group told The Register it was working to restore services after an unspecified IT issue – which it said was caused by a sliced broadband cable – forced the airline to delay and cancel flights.

“Fiber-optic cables belonging to a telecommunications service provider were damaged during construction work in Frankfurt, causing an outage of Lufthansa’s IT systems at the airport in Frankfurt,” a spokesperson said. “Flight operations are expected to stabilize in the early evening.”

In late January, a group calling itself “Anonymous Russia” claimed to have DDoS’d websites belonging to several German airports. These attacks were in response to pro-Kremlin hacktivist crew KillNet’s call to arms after Germany announced the transfer of 14 Leopard 2A6 tanks to Ukraine.

KillNet claimed responsibility for knocking more than a dozen US airports’ websites offline on October 10. However, the large-scale DDoS attack didn’t disrupt air travel or cause any operational harm to the airports.

These incidents are increasing across all industries, in part because they are inexpensive and require little technical skills for miscreants to pull off. Any script kiddie with a currency account and no morals can pay to play.

Over the weekend, Cloudflare said dozens of companies were hit by DDoS attacks, including the largest one yet recorded.

That record-breaking HTTP/2-based traffic tsunami soared to more than 71 million requests-per-second, more than the previous record of 46 million blocked by Google in June 2022. These DDoS attacks weren’t linked to KillNet, according to Cloudflare, which blamed the weekend incidents on unknown attackers. ®