DDoS Attack on KrebsOnSecurity.com using Russkill Botnet

One of Security News provider KrebsOnSecurity hacked using the DDOS attack.  The site is unavailable between Nov17 and Nov18, according to their post.

Attackers launched the DDOS attack using more than 20,000+ Zombie(infected with malware) PCs around the world .

KrebsOnSecurity shared the log files of the attack with Joe Stewart, director of malware research at Dell SecureWorks. Stewart discovered that the botnet responsible for hitting my site appears to have been created with Russkill, a commercial crimeware kit that is sold for a few hundred bucks on the hacker underground. Russkill, sometimes called Dirt Jumper, does its dirty work by forcing infected systems to rapidly request the targeted site’s homepage.

He suspect that the control center for this botnet is noteye.biz, based on traffic analysis of Internet addresses in the logs.

“I did not already have [noteye.biz] under monitoring so it is impossible to say for sure what targets were hit in the past,” Stewart wrote in an email. He noted that the same attacker also apparently runs a Dirt Jumper botnet at xzrw1q.com, which also is currently attacking Ukrainian news site genshtab.censor.net.ua, and kidala.info (“kidala” is Russian slang for “criminal,” and kidala.info is a well-known Russian crime forum).