The Latest in IT Security

Win32/Flooder.Ramagedos botnet participating in DDoS related to elections in Russia


Russia has been in the news for the last week, with thousands of protesters taking to the street to protest against alleged irregularities in the elections held on December 4th. There are also multiple reports of attempts to silence protesters on the Internet, such as DDoS attacks against websites used by the political opposition, the use of Twitter bots to flood messages with specific hashtags related to the protests or by requesting that social networks close groups associated with the protests, as is demonstrated by this letter made public by the owner of the Vkontakte social network.

This week we noticed a botnet using a piece of malware detected as Win32/Flooder.Ramagedos by ESET targeting its distributed denial of service (DDoS) attack at the website, a forum with a section for discussions on politics in Russia. It contains multiple messages related to the recent events regarding the elections.

The forum currently has a notice stating that “We are under DDOS-attack by unknown persons. We do everything to keep the forum working. Thank you for being with us!”.


It turns out that the botnet is currently targeting another website named, participating in a DDoS attack that has being ongoing for 3 weeks now. The website contains an errata section (a mirror is available at with the aim to “enlighten readers about errors, omissions, incidents, plagiarism, lies, and charlatans in the security industry”. Chances are the website is targeted by an individual who is displeased to see his name appearing there.

Those 2 cases are good illustrations of DDoS being used for censorship purposes. Based on the collected evidence, about 4500 computers are participating in the DDoS attacks. While this is a relatively small number for a botnet, it is sufficient to disrupt access to websites with limited bandwidth and no specific DDoS protection.

Leave a reply



Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...



Latest Comments