Rebirth: a new botnet for DDoS attacks on game servers

Tomcat

Professional
Messages
2,379
Reputation
4
Reaction score
407
Points
83
Did your ping jump? Perhaps one of your rivals is a latent cyber villain.

In today's digital world, where online games occupy a significant place in the lives of many people, cybercrime does not stand still. One of the most common types of attacks on game servers is DDoS attacks. These attacks can disable the server, making it inaccessible to users.

Recently, cyber experts at Sysdig revealed details about a powerful new tool specifically designed for such attacks. The growing popularity of the Rebirth botnet, based on the well-known Mirai malware family, offers DDoS attack services via Telegram and the company's web store. This botnet is actively used in the gaming community to attack servers and gain financial benefits.

The most affordable plan, Rebirth Basic, costs $15, while Premium, Advanced, and Diamond plans cost $47, $55, and $73, respectively. The Rebirth API ACCESS plan is also available for $53.

The Rebirth malware supports the functionality to launch DDoS attacks over TCP and UDP protocols, such as TCP ACK flood, TCP SYN flood, and UDP flood.

This is not the first time that game servers have been targeted by DDoS botnets. So, in December 2022, Microsoft revealed details about another botnet called MCCrash, targeting private Minecraft servers. And in May 2023, Akamai described the Dark Frost DDoS botnet, which was observed during attacks on game companies, game server hosting providers, online streamers, and even other members of the gaming community.

Sysdig experts believe that potential Rebirth clients can use this botnet for DDoS trolling, in which attacks are launched against game servers to disrupt the experience of legitimate players.

"With the Rebirth botnet, a person can attack the game server or other players in real time, causing game crashes and slowdowns, lags and connection crashes," Sysdig said.

"Such attacks can be financially beneficial for some content creators on streaming services, whose income depends on the number of subscribers." Thus, unscrupulous streamers can "eliminate competitors", increasing their own popularity and earnings.

In addition, in March of this year, we already wrote about the high-profile hacking of one of the esports players participating in the Apex Legends tournament, which was hacked literally live, in front of thousands of viewers. At that time, the hackers did not pursue financial goals, but they caused a notable stir in the gaming community.

Returning to the Rebirth botnet, the attack chains that spread this malware involve exploiting known security vulnerabilities (for example, CVE-2023-25717) to deploy a bash script, which subsequently loads and executes a DDoS botnet depending on the processor architecture.

Thus, cybercrime in the gaming industry is a serious threat that can disrupt the gameplay and cause financial damage to both players and content creators.

DDoS attacks using malicious botnets, such as Rebirth, have long been offered on the shadow market and are actively used by unscrupulous players to gain an advantage over rivals or financial gain.

All this highlights the need to strengthen cybersecurity in the gaming industry, as well as the importance of ethical behavior and respect for other members of the gaming community. Only through joint efforts can we counter this threat and ensure a fair and safe gaming environment for everyone.
 
Top