GOLD FLANDERS

GOLD FLANDERS was a financially motivated group responsible for distributed denial of service (DDoS) attacks linked to extortion emails demanding between 5 and 30 bitcoins. The attacks consisted mostly of fragmented UDP packets (DNS and NTP reflection) as well as other traffic that varied per victim. The arrival of the extortion email was timed to coincide with a DDoS attack. This consisted of traffic targeted at a particular Autonomous System Number (ASN) or group of IP addresses at rate between 20 Gbps and 200 Gbps and 12 to 15 million packets per second. Attacks lasted between 20 and 70 minutes. In some cases, victim organisations replied to these extortion emails and received personal replies from GOLD FLANDERS operators within 20 minutes.
The extortion emails claimed to be from high-profile APT threat groups such as "Fancy Bear", "Cozy Bear" and "Lazarus". However, CTU researchers assess that these names were being used to apply extra gravitas to the threats and GOLD FLANDERS was in no way associated with the actual APT threat groups it claimed to represent. There was also no indication of any network compromise linked to this DDoS activity.
In only a fraction of cases was there any reported follow-up DDoS attack as threatened. Organizations who used the six-day grace period allowed by GOLD FLANDERS to implement network DDoS filtering controls reported no alerts of further attacks.