You are advised to look out for emailed threats to cripple your organisation’s network and internet services unless you pay the equivalent of several thousand dollars in the digital currency Bitcoin. The New Zealand Internet Taskforce (NZITF) is warning that ‘an unknown international group’ is threatening Australian and New Zealand organisations with Distributed Denial of Service (DDoS) attacks unless they pay 25 Bitcoin each.

A DDoS attack floods a system with useless data, or requests for data, from several sources to overload the network in order to interrupt or suspend services. Bitcoin is a peer to peer currency with no central bank that relies on cryptography to secure and control transactions. While Bitcoin values can fluctuate in the same way as national currencies, some websites claim that one Bitcoin is worth the equivalent of over AUD$200.

NZITF Chair Barry Brailey warns the threat is ‘not idle’ with four New Zealand organisations and ‘a number’ of Australian organisations targeted to date.

The group behind the threat typically sends emails to several addresses within an organisation. Some of these threats go to support or helpdesk addresses while others go to individuals. NZITF says the emails may include links to news articles about attacks the group has perpetrated, and include statements such as:

‘Your site is going under attack unless you pay 25 Bitcoin’

‘We are aware that you probably don’t have 25 BTC at the moment, so we are giving you 24 hours.’

‘IMPORTANT: You don’t even have to reply. Just pay 25 BTC to [bitcoin address] – we will know it’s you and you will never hear from us again.’

Staying safe

Educate the staff in your organisation to be on the lookout for these emails and to advise the appropriate personnel if they receive one.

Report the incident to the Australian Cybercrime Online Reporting Network (ACORN). ACORN provides information on how to recognise and avoid common forms of cybercrime, such as hacking, online scams, online fraud, identity theft, attacks on computer systems and illegal or prohibited content, as well as offering advice to those who have fallen victim. ACORN makes it easier and more convenient to report cybercrime to a law enforcement agency.

You are advised to consider the consequences of paying to remove the threat. There are no guarantees your organisation will not be targeted again in future.