VTB Bank, Russia’s second largest financial institution, has disclosed that they are facing the “worse cyber attack in its history” after its website and mobile apps were rendered inoperable as a result of a Ukrainian-led DDoS attack.
What is a DDoS attack?
A Distributed Network attack, also known as a Distributed Denial of Service attack (DDoS), takes advantage of the specific capacity limits that apply to network resources to render an online resource inoperable. This is achieved by sending multiple requests to a targeted online resource, for example, a website, with the aim of exceeding the website’s capacity to handle multiple requests, therefore preventing the website from functioning correctly.
This attack stops online resources from working due to network infrastructure, such as web servers, having a finite limit to the number of requests that they can answer at the same time. In addition to the servers having a finite capacity limit, the digital channel that connects the server to the internet will also have a finite bandwidth.
Whenever the number of requests to an online resource exceeds its capacity limits, users of the resource are likely to suffer from slower response times, or be unable to access the resource at all (a ‘denial of service‘).
Traditionally these attacks have been used in ransom attempts, with cyber criminals targeting major online retailers by preventing their customers from purchasing through their website. However DDoS attacks have increasingly found a place amongst hacktivist groups, who seek to punish a government or organisation for unethical actions, such as Anonymous’ attack on the Russian Government’s website at the start of the Ukraine war.
Â
Â
DDoS attack on VTB Bank
“At present, the VTB technological infrastructure is under unprecedented cyber attack from abroad”, as stated by a VTB spokesperson earlier this week.
“It is not only the largest cyberattack recorded this year, but in the entire history of the bank”
The spokesperson also revealed that their internal analysis indicated that the DDoS attack was planned and executed with specific purpose of causing inconvenience to tis customers by disrupting its banking services.
At present, VTB’s online banking service is still offline, but the organisation has stated that all core banking services operate normally.
VTB has also reassured its customers that customer data is protected and stored in the internal perimeter of its infrastructure, which the attackers have not accessed.
Surprisingly, some of the DDoS requests involved in the attack originated from Russian IP addresses, although the majority were international. This implies that the Ukrainian group behind the attack either used local proxy agents, or recruited local dissidents.
It is likely that VTB Bank was targeted due to their involvement with the Russian Government. VTB is 61% state-owned, and so the hacktivists behind the attack will view this as a direct blow to the Russian government.
Â
Â
Hacktivist Group – ‘IT Army of Ukraine’
The Ukrainian hacktivist group, ‘IT Army of Ukraine’ has claimed responsibility for the DDoS attacks, and announced the campaign through social media site Telegram at the end of November:
Â
The IT Army of Ukraine (TIAU) was formed in February 2022, with the permission of the Ukraine Government, as an attempt to strengthen the country’s cyber front.
The group have caused numerous incidents of disruption to the lives of Russians, including major disruption to a leading Russian aerospace and defence conglomerate, and a long-lasting outage to an online portal utilised by vodka producers and distributors.
TIAU has been particularly active in November, targeting over 900 Russian entities, including the Central Bank of Russia, the National Centre for the Development of Artificial Intelligence, and Alfa bank.
The first signs of the DDoS attack occurred a few days after TIAU made their announcement when VTB customers complained on social media that the bank’s services were down:
Â
Â
Although VTB Bank initially tried to play off the disruption to their services, they were eventually forced to admit the attack, after the severity and long-lasting effects became evident.
Â
