What is Ransom DDoS (RDDoS) | How to Protect Your Infrastructure

Ransom DDoS (RDDoS) is an extortion scheme in which threat actors launch or threaten to launch DDoS attacks against an organization unless a cryptocurrency ransom is paid. Unlike ransomware, RDDoS does not encrypt or steal data—it threatens service availability. The attacks typically target revenue-critical infrastructure: e-commerce platforms, financial services, gaming networks, and VoIP providers.

Last updated: 2026-07-27

TL;DR: RDDoS attackers send a ransom demand alongside or before a DDoS attack, threatening sustained or escalating attacks unless payment is made—typically in Bitcoin or Monero. Paying does not guarantee the attack stops and attracts repeat targeting. The correct response is to implement DDoS protection, report to law enforcement, and not pay the ransom.

How RDDoS Works

RDDoS campaigns follow a three-phase pattern:

Phase 1: Threat

The attacker sends an email to the organization’s abuse or security contact with:

• A claim to represent a known threat group (Lazarus Group, Fancy Lazarus, REvil)
• A ransom demand, typically 1–5 Bitcoin
• A deadline (24–72 hours before the attack escalates)
• A description of the attack capabilities and targets

The group may or may not have the attack capability claimed. Many RDDoS threats are bluffs—or use the threat group’s name without authorization.

Phase 2: Demonstration Attack

To demonstrate capability and create urgency, attackers often launch a short (15–30 minute) DDoS attack against the target. This attack:

• Confirms the attacker has a real DDoS capability
• Creates urgency by showing what a sustained attack would feel like
• Provides the organization with evidence to evaluate the threat

Demonstration attacks typically range from 10 to 200 Gbps, targeting bandwidth or specific services.

Phase 3: Demand and Escalation

If the ransom is not paid before the deadline:

• Attackers launch sustained DDoS attacks (hours to days)
• Ransom demand increases with each escalation
• New deadlines are issued with higher demands

Attackers claim that paying quickly (before the deadline) results in a lower price.

Notable RDDoS Groups and Campaigns

Fancy Lazarus was one of the most significant RDDoS campaigns of recent years, targeting financial institutions, telecoms, and internet service providers in over 30 countries in 2020–2021. The group impersonated the state-sponsored Lazarus Group and Fancy Bear to add credibility to threats.

The FBI and CISA issued a joint advisory in November 2021 warning organizations about RDDoS campaigns and recommending against payment.

Who Gets Targeted

Public RDDoS advisories show that extortion campaigns commonly target industries where downtime has immediate revenue, operational, or public-safety impact:

Organizations are often targeted when they appear in financial filings, tech press (product launches, IPOs), or have publicly visible critical availability requirements.

Why Not to Pay

Security agencies worldwide—including the FBI, CISA, NCSC (UK), and Europol—recommend against paying RDDoS ransoms for several reasons:

1. No guarantee the attack stops. Attackers may take payment and continue the attack. There is no enforcement mechanism.
2. Marks the organization as willing to pay. Paying signals to the attacker (and the broader criminal community) that the organization will pay. Repeat attacks within weeks are common.
3. Funds further attacks. Payment finances botnet infrastructure and future campaigns.
4. Attracts additional groups. News of payment can circulate in criminal forums, attracting other extortion attempts.
5. Attacks often stop anyway. Many RDDoS threats are bluffs. Organizations with DDoS protection that absorbs the demonstration attack often never receive a sustained attack.

Key principle: paying does not create a reliable service-level agreement with criminals. It can also identify the organization as willing to pay, increasing the chance of repeat extortion attempts.

Responding to an RDDoS Threat

Do not pay. Contact the following instead:

1. Activate DDoS protection immediately. If not already deployed, contact your DDoS protection provider for emergency mitigation.
2. Preserve the ransom email. Headers, timestamps, Bitcoin wallet addresses, and email content are evidence for law enforcement.
3. Report to law enforcement:
   • United States: FBI (ic3.gov), CISA (cisa.gov/report)
   • United Kingdom: National Cyber Security Centre (ncsc.gov.uk)
   • EU: Europol (europol.europa.eu/report-crime/cybercrime)
4. Notify your ISP and upstream providers. They can assist with upstream filtering and traffic rerouting.
5. Prepare your incident response plan. Brief security, IT, and communications teams before attacks escalate.

Protection Against RDDoS

Frequently Asked Questions

What is Ransom DDoS? Ransom DDoS (RDDoS) is an extortion scheme where attackers demand cryptocurrency payment under threat of launching sustained DDoS attacks against an organization. Unlike ransomware, RDDoS targets availability—not data confidentiality or integrity.

How does RDDoS differ from ransomware? Ransomware encrypts files or databases and demands payment for the decryption key. RDDoS threatens service availability through DDoS attacks and demands payment to stop or not launch the attack. RDDoS does not require the attacker to penetrate internal systems—only to send traffic at the target from the outside.

Should I pay an RDDoS ransom? No. The FBI, CISA, and all major security agencies recommend against payment. Paying does not guarantee the attack stops, marks your organization as willing to pay, and funds further criminal activity. Organizations with DDoS protection in place rarely see sustained attacks after refusing to pay.

What is the typical RDDoS ransom demand? Demands range from 1 to 20 Bitcoin, typically with a deadline of 24–72 hours. Some campaigns have demanded 1 BTC initially with increases of 1 BTC per day the demand is not met. The demand amount is designed to be painful but below the cost of extended downtime.

Are RDDoS threats always real? No. Many RDDoS threats are bluffs—the attacker sends emails claiming to have DDoS capability but never launches an attack. Others launch only a short demonstration attack and do not escalate if payment is refused. The presence of a demonstration attack increases the probability the attacker has genuine capability, but even groups with real capability may not sustain attacks if the ransom is refused.

Which groups conduct RDDoS campaigns? Most active groups use names designed to increase fear—Lazarus Group, Fancy Bear, Armada Collective—without being the actual state-sponsored groups. Impersonation is common. The actual operators are typically criminal organizations rather than nation-states, though attribution is difficult.

How quickly can I get DDoS protection if I receive an RDDoS threat? Major cloud DDoS protection providers can provision protection in minutes to hours through self-service portals. Activation is typically faster if you already have an account. Contact your DDoS protection provider’s emergency response line immediately upon receiving a credible threat.

Is it illegal to pay an RDDoS ransom? In some jurisdictions, paying ransoms to sanctioned entities is illegal under anti-money laundering and sanction regulations. The US Treasury’s OFAC has warned that ransom payments to sanctioned groups may violate US law. Even where not illegal, paying provides no guaranteed benefit.

How to Implement on Azion

Azion’s platform provides the DDoS protection needed to withstand RDDoS attacks without paying ransoms:

• DDoS Protection is always-on, with no manual activation required—protection is in place before a threat arrives
• Network Layer Protection blocks volumetric DDoS attacks at the network layer
• WAF protects against Layer 7 attacks that accompany volumetric floods in multi-vector RDDoS
• WAAP integrates DDoS protection, WAF, and bot management for comprehensive protection

If you receive an RDDoS threat targeting infrastructure on Azion, contact Azion support immediately to activate enhanced monitoring.

Related Resources

• What Is a DDoS Attack?
• What Is DDoS Protection and Mitigation?
• What Is a DDoS Botnet?
• Azion DDoS Protection
• DDoS Attack Types

Sources:

• FBI / CISA. “Ransom DDoS Attacks Advisory.” November 2021.
• CISA. “Understanding and Responding to Distributed Denial-of-Service Attacks.”
• Europol. “DD4BC DDoS Extortion Criminal Network Dismantled.” Press Release, 2016.
• US Department of Treasury OFAC. “Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments.” 2021.
• Krebs on Security. “Fancy Lazarus DDoS Extortion Blitz.” 2021. Ransom DDoS (RDDoS) is an extortion campaign in which threat actors threaten to execute — or briefly demonstrate — distributed denial-of-service attacks against an organization, demanding payment (usually in cryptocurrency) to cease or not initiate the attack.

In some cases, RDDoS occurs as extortion focused exclusively on availability — without internal compromise, data access, or ransomware. In more complex campaigns, it may be combined with ransomware, data exfiltration, leak threats, and application abuse. Not every RDDoS involves internal compromise; not every ransomware involves DDoS; not every extortion with exfiltrated data involves ransomware.

What is Ransom DDoS (RDDoS)?

The typical cycle of a DDoS extortion campaign follows a recognizable pattern. In the reconnaissance phase, the threat actor identifies targets with high online availability dependency — e-commerce, financial services, gaming platforms, cryptocurrency exchanges — and gathers information about the target’s technical infrastructure.

In the demonstration phase (optional, but common), a brief DDoS attack is executed — illustratively, ranging from a few minutes to several tens of minutes — sufficient to cause perceptible degradation but not necessarily to completely bring down the service. The objective is to create urgency and indicate the threat has some operational substance.

In the demand phase, the actor sends communication — usually email — demanding cryptocurrency payment with a defined deadline. The message frequently attributes the campaign to known APT groups (such as Fancy Bear or Lazarus Group) to inflate the perception of sophistication — which, in isolation, is not evidence of genuine capability.

In the decision phase, the organization must respond in a coordinated way, without impulsiveness. The nature and extent of the response depend on the incident profile, jurisdiction, contracts, sector regulation, and risk assessment.

In the execution or abandonment phase, predominantly opportunistic groups may abandon if the target demonstrates active protection or ignores the demand. Groups with greater operational capability or motivation beyond financial gain may execute the attack regardless of payment.

How does a Ransom DDoS campaign work?

HTTP Flood and Layer 7 API abuse

Modern RDDoS attacks frequently operate at the application layer (L7) rather than the network layer (L3/L4), making them harder to detect by exclusively volumetric monitoring systems. Automated tools, headless browsers, and scripts are used to send syntactically valid HTTP requests that exhaust the application’s business logic without generating simple bandwidth anomalies.

An HTTP Flood directed at critical API endpoints — such as authentication, payment processing, or report generation — can impact a service with considerably lower traffic volume than a volumetric L3/L4 attack, because the computational cost per request is higher. Threat actors who understand the target’s internal API structure can concentrate the attack on especially costly endpoints, maximizing impact with minimal traffic volume.

QUIC Flood — vectors over UDP

The emergence of HTTP/3 over the QUIC protocol created an additional attack surface in RDDoS campaigns. QUIC uses UDP as encapsulation and integrates TLS 1.3. Security devices that do not terminate QUIC can apply L3/L4 controls and observe flow metadata, but generally cannot fully inspect HTTP/3 requests, headers, and application logic without TLS termination. Controls possible without termination include UDP filtering, rate limiting, IP/port policies, flow analysis, and behavioral detection.

On QUIC amplification: RFC 9000 defines address validation mechanisms, including the Retry packet. Before address validation, QUIC servers must apply an anti-amplification limit — as a general rule, not sending more than three times the bytes received before validating the client’s address. These controls reduce exposure to spoofing and reflection, but do not eliminate attacks from botnets with real IPs or pressure on CPU and user-space resources.

Low-and-slow attacks transported over QUIC may limit Layer 7 visibility for tools that do not terminate QUIC/TLS. Even so, network signals such as flow duration, packet rate, volume, connection behavior, and pressure on UDP/443 can still be monitored.

RDDoS and multiple extortion: when ransomware and exfiltration are involved

The terminology “double,” “triple,” and “quadruple extortion” varies across threat intelligence reports and is not uniformly standardized in the industry. The terms are used here to describe the progressive combination of pressures — not as a definitive or universal taxonomy.

Ransomware and unavailability as additional pressure

In some campaigns, the threat actor infiltrates the organization’s network, encrypts internal data, and demands ransom for the decryption key. DDoS may be added as parallel pressure: if the victim delays payment or attempts to recover data independently, the unavailability of external services increases the operational cost of resistance. These are two distinct threats with different access vectors — the presence of one does not automatically imply the other.

Data exfiltration and leak threats

In other campaigns, before encrypting or destroying data, the actor exfiltrates it. The demand includes a threat to publish data on criminal forums or sell it to third parties. For organizations subject to GDPR or other privacy regulations, this substantially raises the potential regulatory impact — but the specific obligations depend on the circumstances of the incident, as detailed in the governance section.

Pressure on customers, partners, and third parties

In broader campaigns, the actor may directly contact the organization’s customers, partners, suppliers, or shareholders, informing them about the incident and creating external reputational and regulatory pressure. DDoS-for-hire services (booters or stressers) can reduce the barrier to entry for opportunistic extortionists — these services may abuse botnets, compromised devices, exposed servers, or improperly used infrastructure. The use of a third-party service does not prove authorship or the group’s own technical capability.

Technical vectors used in RDDoS campaigns

The most frequent vectors in DDoS extortion campaigns include:

• Volumetric L3/L4: UDP, ICMP, SYN floods, and DNS amplification — exhaust network capacity or packet processing.
• HTTP Flood L7: valid requests that exhaust CPU, database, or business logic.
• API abuse: exploitation of costly endpoints, authentication, webhooks, or integrations.
• QUIC Flood: floods over UDP/443, pressure on CPU and user-space state.
• Low and Slow: low-rate attacks that keep connections open or exhaust workers.
• SYN Flood: exhaustion of TCP connection queues.

Sophisticated campaigns frequently combine multiple vectors to complicate selective mitigation.

How to evaluate the credibility of an RDDoS threat

Evaluating the credibility of a threat requires evidence-based analysis — not reliance on claims. The presence of an isolated signal does not prove genuine capability nor confirm a bluff; it must be interpreted in conjunction with all other available information.

Attribution of an RDDoS to a specific group is uncertain even for specialized teams. A demonstration attack may be executed with DDoS-for-hire services. APT impersonation is a common tactic of opportunistic extortionists.

Mitigation architectures: scrubbing, always-on, and edge

The choice of protection architecture has a direct impact on response capacity during an RDDoS, especially given the element of surprise inherent in extortion campaigns.

On-demand scrubbing

In the on-demand scrubbing model, traffic is diverted to a cleaning center after attack detection. The time between detection, activation, and the start of effective mitigation depends on automation, BGP route propagation, topology, providers, and pre-provisioning — and can vary from seconds to longer periods. During that interval, the attack may cause unavailability.

Some scrubbing centers operate predominantly at L3/L4. Others include reverse proxy, WAF, API protection, and L7 controls. Coverage must be validated per protocol, flow, product, and specific architecture.

Always-on scrubbing

In the always-on scrubbing model, traffic may already pass through the mitigation network or have pre-provisioned routes and tunnels, reducing convergence time. Detection and the start of mitigation tend to be faster, but performance depends on configuration, automation, and the nature of the attack.

Distributed edge protection

In the distributed edge model, traffic can be inspected and filtered at edge data centers before reaching the origin server. A distributed always-on architecture can reduce reaction time and apply controls before traffic reaches the origin. Its performance depends on geographic coverage, capacity, configuration, mitigation policies, the nature of the attack, and application integration.

Hybrid models

Organizations with high maturity levels frequently combine elements of the above models, adapting the architecture to the risk profile and impact tolerance. The organization should test its mitigation process in controlled exercises to understand real behavior under attack.

For more details on the differences between centralized scrubbing and its alternatives, see the specific article on mitigation architectures.

Governance, payment, and legal risk

Why authorities discourage payment

Security authorities frequently discourage payments because:

• they do not guarantee the attack stops;
• they may encourage new extortion demands, including from other groups;
• they may generate legal, financial, and reputational risks;
• they confirm to the actor that the organization is receptive to yielding.

The decision on communication, negotiation, or payment requires formal evaluation with executive leadership, legal, privacy, incident response, cyber insurance — where applicable — and competent authorities. Organizations must not respond impulsively to the attacker or make decisions without coordination.

Legal and regulatory risks

Exposure under sanctions regimes: for organizations with exposure to the United States, transactions involving sanctioned persons, entities, or wallets may generate significant risks under regimes administered by OFAC (Office of Foreign Assets Control). Evaluating this risk requires specialized legal advice considering the jurisdiction, contracts, and characteristics of the incident.

GDPR: the EU General Data Protection Regulation requires notification to the relevant supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal data breach. An isolated DDoS attack does not in itself imply a personal data breach. If there is evidence of unauthorized access, exfiltration, or other applicable impact on personal data, legal and privacy teams must be engaged immediately.

Other jurisdictions: regulatory obligations vary by jurisdiction and sector. The organization’s legal team and privacy counsel must be engaged to assess applicable obligations.

Initial incident response playbook for RDDoS

The timeline below is an initial prioritization model. Activities may occur in parallel and must be adapted to the impact, jurisdiction, contracts, regulated sector, operational maturity, and nature of the incident.

Immediate priorities (T+0)

• Preserve all evidence before any other action.
• Verify whether an attack is underway: analyze logs, alerts, user reports, and network dashboards.
• Confirm coverage and status of active DDoS protection.
• Engage SOC, NOC, SRE, network, and product teams according to the scope of impact.
• Check for indicators of intrusion and possible exfiltration — a DDoS attack may be a distraction vector.
• Elevate monitoring and telemetry on critical services.
• Document all decisions and the incident timeline.

Immediate technical containment

• Activate or escalate DDoS protection with the provider or mitigation service.
• Apply rate limiting, geoblocking, or WAF rules where applicable and pre-tested.
• Protect critical endpoints and services that may be targets of parallel abuse.
• Verify connectivity status with upstreams and transit providers.

Governance and legal

• Engage executive leadership for alignment and authorization of decisions.
• Engage legal, privacy, and compliance as early as possible.
• Assess cyber insurance coverage where applicable.
• Evaluate regulatory and contractual obligations specific to the sector and jurisdiction.
• Assess international exposure and sanctions risks as applicable.
• Define responsibilities for internal communication, communication with customers and partners, and communication with authorities.

Communication with the attacker

• Do not respond impulsively to the threat actor.
• Do not negotiate or authorize payment without formal coordination with legal and leadership.
• Preserve the original message and its metadata unchanged.
• Follow legal counsel and competent authority guidance before any action.

Evidence and forensic analysis

Demand email: headers and metadata can assist investigation of campaigns and infrastructure. Elements to preserve and analyze include: Received chain, message identifiers, timestamps, domains, potentially compromised accounts, intermediary services, attachments, links, and mentioned wallet addresses. Headers must not be interpreted in isolation as definitive proof of the attacker’s real origin, but are evidence that authorities can use in the investigation.

Cryptocurrency addresses: must be preserved as evidence and shared with authorities, legal, and authorized specialists. Public tools and commercial blockchain analytics platforms can help correlate indicators, but attribution requires caution and multiple sources of evidence.

Traffic capture: if possible and without operational impact, preserve samples of the attack traffic for subsequent analysis.

Authority reporting

Reporting channels depend on jurisdiction, sector, and impact. Depending on the circumstances, it may be appropriate to evaluate reporting to:

• US: FBI IC3 — accepts reports from international companies with US impact.
• EU: Europol EC3 (Cybercrime Centre) for European organizations.
• UK: NCSC (National Cyber Security Centre).
• Sector regulators — in sectors such as financial, health, and energy, where applicable.
• Affected contractual partners — as required by contract.

Post-incident communication

Premature public communication during the crisis can amplify the reputational impact and signal to the actor that the pressure is working. After resolution, post-incident transparency with customers and partners is generally valued and may be mandatory depending on the sector and applicable regulation.

Most targeted sectors

RDDoS and multiple extortion: comparison

Common mistakes and guidance

Keeping the demand secret to avoid public exposure: reporting to authorities is operationally useful and may be legally mandatory in regulated sectors. Confidentiality of reporting is generally preserved during active investigation.

Negotiating with the threat actor without coordination: any direct communication must be preceded by legal guidance and leadership alignment. Negotiating without coordination may confirm to the actor that the organization is considering yielding and increase pressure.

Activating DDoS protection only after receiving the demand: the interval between the demand and the attack may be short — insufficient to implement, test, and validate protection from scratch. Proactive protection must be in place before incidents occur.

Assuming APT impersonation indicates equivalent capability: most RDDoS groups are opportunists who attribute campaigns to APTs to inflate credibility. Evaluate the threat by observed technical evidence, not by the name in the message.

Paying without legal and risk assessment: the decision to pay or not must be made with specialized legal counsel, evaluating criminal, regulatory, compliance, and sanctions risks, as well as the operational and reputational impact of both options.

Frequently asked questions

Is RDDoS different from ransomware extortion? Yes, in the primary vector. Ransomware requires internal infiltration and encrypts data — the damage is internal and direct. RDDoS, in its isolated form, threatens availability through an external network attack, without necessarily accessing internal systems. In multiple extortion campaigns, the two may be combined — but the presence of one does not automatically imply the other.

Is every DDoS attack during an extortion an RDDoS? Not necessarily. The defining characteristic of RDDoS is the explicit payment demand as a condition for ceasing or not initiating the attack. A DDoS attack without a demand may have ideological, competitive, or other motivations — and must be investigated independently.

What are the specific regulatory risks under GDPR? An isolated DDoS attack does not in itself imply a personal data breach or automatic notification obligation. If the incident involved unauthorized access, exfiltration, or unavailability of systems handling personal data, the organization must immediately engage legal and privacy counsel to assess applicable obligations. Under the GDPR, notification to the supervisory authority must occur without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

How do email headers help in the investigation? Email headers and metadata can assist investigation of campaigns and infrastructure — including the Received chain, timestamps, domains, message identifiers, and intermediary services. They must not be interpreted in isolation as definitive proof of the threat actor’s real origin, but are evidence that authorities can use in the investigation.

Do RDDoS groups generally attack even without receiving payment? It depends on the operational profile. Groups with a predominantly opportunistic profile may abandon when faced with active protection or no response. Groups with greater operational capability, ideological motivation, or integration with other campaigns may execute the attack regardless of payment. Prior technical preparation is the variable with the greatest impact on resilience, regardless of group type.

How does QUIC Flood affect RDDoS campaigns? QUIC Flood represents a vector that can reduce Layer 7 visibility for devices that do not terminate QUIC/TLS. In campaigns with demonstration attacks, the use of QUIC may be employed to assess the target’s defensive coverage. Monitoring of flow metadata, pressure on UDP/443, CPU, and connection duration can assist detection even without content inspection.

Official references and guidance

• CISA StopRansomware — guides and alerts on cyber extortion
• OFAC Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments — guidance on sanctions risks
• FBI IC3 — Internet Crime Complaint Center
• Europol EC3 — European Cybercrime Centre
• RFC 9000 — QUIC: A UDP-Based Multiplexed and Secure Transport
• RFC 9001 — Using TLS to Secure QUIC

How to implement on Azion

Azion’s distributed architecture can help apply mitigation controls at the edge, reducing the origin’s exposure to malicious traffic. The effective coverage and behavior depend on the contracted products, published protocols, configured policies, and application architecture.

1. DDoS Protection integrated into the edge: Azion’s DDoS protection operates in the edge infrastructure and can help mitigate volumetric and application attacks, including HTTP Flood on APIs, QUIC Flood, and low and slow attacks, as per the products and configurations used.
2. QUIC and HTTP/3 termination at the edge: when QUIC and HTTP/3 traffic is terminated at the edge, Layer 7 controls can be applied after TLS termination, including security policies, rate limiting, and API protection, according to the environment configuration.
3. Observability and incident response: logs, metrics, and observability resources can support incident investigation and adjustment of mitigation policies, according to the products and configurations used.
4. Network Shield and L3/L4 filtering: filters malformed packets, anomalous patterns, and volumetric vectors at Layers 3 and 4, reducing exposure before any application processing.

Learn more in the Azion DDoS Protection documentation.