3 ms·

No body starts a botnet to hit one target. Botnets are usually for hire. You find a vulnerability, establish as many C&C devices as you can, then advertise onli

No body starts a botnet to hit one target. Botnets are usually for hire. You find a vulnerability, establish as many C&C devices as you can, then advertise online that you have a botnet capable of XYZ, and you get contracts to hit particular endpoints. In this example, Swing VPN is offering a "free VPN" service, but they actually pay for it with botnet contracts.

esafak 3y ago
Right. I am interested in who would pay to strike Turmenistan Airlines. It's a target with no apparent value.
- eddythompson80 3y ago
  eh, we don't really know what all "Turmenistan Airlines" website actually does. It's a government agency after all, and it could be used to hide all sorts of online activity for some other government agencies. It could also just be a test contract, or an internal botnet test and OP just happen to catch that one.
- jeroenhd 3y ago
  Getting a target DDoS'd is cheap, especially if that target resides in a country with not that great digital infrastructure. For twenty dollars you can take down an airline that lost your luggage and didn't bother trying to find it back. It's childish behavior, but someone is petty enough. Store didn't honor their warranty? Pay five dollars and they'll lose more money in lost sales than their refusal would've cost them. Sometimes it's not just petty criminals either. Extorting businesses with these types of attacks is all too common. "Pay us $x or your website will be down for months" is an easy threat to make, especially if you can take down a business for a fraction of their lost revenue. Attack twenty or more companies, wait for one of them to pay out and you've made yourself a huge chunk of cash. There are all kinds of reasons to hire these botnets. Developing these botnets isn't very hard either, especially if you can sneak a trojan into a useful software library or hack someone else's library. You just have to think real scummy.

esafak 3y ago

Right. I am interested in who would pay to strike Turmenistan Airlines. It's a target with no apparent value.

eddythompson80 3y ago
eh, we don't really know what all "Turmenistan Airlines" website actually does. It's a government agency after all, and it could be used to hide all sorts of online activity for some other government agencies. It could also just be a test contract, or an internal botnet test and OP just happen to catch that one.
jeroenhd 3y ago
Getting a target DDoS'd is cheap, especially if that target resides in a country with not that great digital infrastructure. For twenty dollars you can take down an airline that lost your luggage and didn't bother trying to find it back. It's childish behavior, but someone is petty enough. Store didn't honor their warranty? Pay five dollars and they'll lose more money in lost sales than their refusal would've cost them. Sometimes it's not just petty criminals either. Extorting businesses with these types of attacks is all too common. "Pay us $x or your website will be down for months" is an easy threat to make, especially if you can take down a business for a fraction of their lost revenue. Attack twenty or more companies, wait for one of them to pay out and you've made yourself a huge chunk of cash. There are all kinds of reasons to hire these botnets. Developing these botnets isn't very hard either, especially if you can sneak a trojan into a useful software library or hack someone else's library. You just have to think real scummy.