{"id":29895,"date":"2019-10-24T19:29:53","date_gmt":"2019-10-24T19:29:53","guid":{"rendered":"http:\/\/8febbc70-4355-49de-9578-d6afd883fe75"},"modified":"2019-10-24T19:29:53","modified_gmt":"2019-10-24T19:29:53","slug":"a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/","title":{"rendered":"A DDoS gang is extorting businesses posing as Russian government hackers"},"content":{"rendered":"<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet4.cbsistatic.com\/hub\/i\/2019\/10\/24\/bae4e434-bb69-44ce-83a2-7df9624b0fce\/aec54a9cf0c66f29e5f63ca393299556\/fancy-bear-logo.png\" class alt=\"Fancy Bear logo\"><\/span><\/p>\n<p>For the past week, a group of criminals has been launching DDoS attacks against companies in the financial sector and demanding ransom payments while posing as &#8220;<a href=\"https:\/\/en.wikipedia.org\/wiki\/Fancy_Bear\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">Fancy Bear<\/a>,&#8221; the infamous hacking group associated with the Russian government, known for hacking the White House in 2014 and the DNC in 2016.<\/p>\n<p>The attacks, brought to <em>ZDNet<\/em>&#8216;s attention by one of our readers, were confirmed today by <a href=\"https:\/\/www.link11.com\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Link11<\/a> and <a href=\"https:\/\/radware.com\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Radware<\/a>, two companies that provide DDoS mitigation services and have documented similar &#8220;ransom denial-of-service&#8221; (RDOS) attacks in the past years.<\/p>\n<p>In an interview with <em>ZDNet<\/em>, Daniel Smith, Radware ERT researcher, said the attacks started last week and targeted the financial vertical.<\/p>\n<p>Smith said &#8220;the group is launching large scale, multi-vector demo DDoS attacks when sending victims the ransom letter.&#8221;<\/p>\n<p>A Link11 spokesperson said the same thing, adding that the purpose of these demo attacks is to serve as an initial warning and intimidation factor, to convince victims into paying the ransom demand.<\/p>\n<p>According to a copy of the ransom letter [<a href=\"https:\/\/lp.link11.de\/share\/public\/Link11_Fancy-Bear_Erpressermail.pdf\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">PDF<\/a>] the group is sending victims, the fake Fancy Bear group is asking for payments of 2 bitcoin, which is about $15,000 at today&#8217;s exchange rate.<\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/article\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/\" class=\"lazy\" alt=\"fb-extortion.png\" data-original=\" https:\/\/zdnet3.cbsistatic.com\/hub\/i\/2019\/10\/24\/db59f973-4c30-458e-8850-7acc672e5dce\/d5310636c4f77aee40c42846b6880bb5\/fb-extortion.png\"><\/span><noscript><\/p>\n<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet3.cbsistatic.com\/hub\/i\/2019\/10\/24\/db59f973-4c30-458e-8850-7acc672e5dce\/d5310636c4f77aee40c42846b6880bb5\/fb-extortion.png\" class alt=\"fb-extortion.png\"><\/span><\/p>\n<p><\/noscript> <span class=\"credit\">Image via Link11<\/span><\/p>\n<p>Link11&#8217;s Thomas Pohle said these demo attacks are a mixture of different protocols, such as DNS, NTP, CLDAP, <a href=\"https:\/\/www.zdnet.com\/article\/macos-systems-abused-in-ddos-attacks\/\" target=\"_blank\" rel=\"noopener noreferrer\">ARMS<\/a>, and <a href=\"https:\/\/www.zdnet.com\/article\/protocol-used-by-630000-devices-can-be-abused-for-devastating-ddos-attacks\/\" target=\"_blank\" rel=\"noopener noreferrer\">WS-Discovery<\/a>.<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>Furthermore, the extortionists appear to study and choose their targets in advance. Pohle said the DDoS attacks don&#8217;t target companies&#8217; public website, but at their backend servers, which aren&#8217;t usually protected by DDoS mitigation systems and cause downtimes &#8212; and possibly intimidating victims.<\/p>\n<p>In addition, Pohle said that beyond the financial vertical, they&#8217;ve also seen some DDoS ransom attacks aimed at companies in the entertainment and retail business.<\/p>\n<p>&#8220;The victims are threatened with a follow-up DDoS attack if they do not make a payment in bitcoin within a week,&#8221; Radware&#8217;s Smith told <em>ZDNet<\/em>. &#8220;At the moment, no follow-up attacks have been observed.&#8221;<\/p>\n<h3>Revival of a 2017 trend?<\/h3>\n<p>Smith also said the ransom letter used this past week is <a href=\"https:\/\/security.radware.com\/ddos-threats-attacks\/threat-advisories-attack-reports\/fancybear\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">nearly identical to one used in 2017<\/a> by another DDoS ransom gang that also posed as Russia&#8217;s Fancy Bear group.<\/p>\n<p>In fact, 2017 has been the year when DDoS-based ransom demands reached their peak, with dozens of groups operating all at the same time.<\/p>\n<p>Some DDoS extortionists were seen posing as almost any widely-known hacking group known at the time, such as Anonymous, LulzSec, Armada Collective, New World Hackers, Lizard Squad, and Fancy Bear.<\/p>\n<p>Other groups didn&#8217;t bother imitating better known hacking groups and tried making a name for themselves, such as Kadyrovtsy, RedDoor, ezBTC, Borya Collective, Stealth Ravens, XMR Squad, ZZb00t, Meridian Collective, Xball Team, and Collective Amadeus.<\/p>\n<p>It was a free-for-all for almost the entire year, but attacks subsided as victims learned that many extortionists did not have the firepower to follow through with actual DDoS attacks.<\/p>\n<p>But unlike its 2017 predecessors, this new Fancy Bear copycat that emerged last week at least appears to own an actual DDoS botnet.<\/p>\n<p>However, it is worth mentioning that they are not the real Fancy Bear group. Russia&#8217;s elite cyber-espionage and hacking unit have never been seen launching DDoS attacks. Their targets usually include embassies, NATO bases, US political parties, and government agencies.<\/p>\n<p>Any company receiving such email threats should report the incident to law enforcement officials.<\/p>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Exclusive: Fake &#8220;Fancy Bear&#8221; group is demanding money from companies in the financial sector, threatening DDoS attacks.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":29896,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-29895","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>A DDoS gang is extorting businesses posing as Russian government hackers 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A DDoS gang is extorting businesses posing as Russian government hackers 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2019-10-24T19:29:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/10\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"455\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"A DDoS gang is extorting businesses posing as Russian government hackers\",\"datePublished\":\"2019-10-24T19:29:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/\"},\"wordCount\":568,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/\",\"name\":\"A DDoS gang is extorting businesses posing as Russian government hackers 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png\",\"datePublished\":\"2019-10-24T19:29:53+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/10\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png\",\"width\":1000,\"height\":455},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A DDoS gang is extorting businesses posing as Russian government hackers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A DDoS gang is extorting businesses posing as Russian government hackers 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/","og_locale":"en_US","og_type":"article","og_title":"A DDoS gang is extorting businesses posing as Russian government hackers 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2019-10-24T19:29:53+00:00","og_image":[{"width":1000,"height":455,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/10\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"A DDoS gang is extorting businesses posing as Russian government hackers","datePublished":"2019-10-24T19:29:53+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/"},"wordCount":568,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/10\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/","url":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/","name":"A DDoS gang is extorting businesses posing as Russian government hackers 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/10\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png","datePublished":"2019-10-24T19:29:53+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/10\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/10\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers.png","width":1000,"height":455},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"A DDoS gang is extorting businesses posing as Russian government hackers"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/29895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=29895"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/29895\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/29896"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=29895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=29895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=29895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}