Dutchman arrested in Spain for DDoS attacks on Spamhaus

Posted by   Virus Bulletin on   Apr 29, 2013

Suspect drove around in 'mobile bunker' to co-ordinate attacks.

Police in Spain have arrested a 35-year-old Dutchman, believed to be responsible for the DDoS attacks on Spamhaus last month.

Although the Dutch public prosecutor has only identified the suspect as 'SK', it is almost certain that he is Sven Olaf Kamphuis, spokesman for hosting provider CyberBunker. It was the blacklisting of CyberBunker's IP addresses that triggered the DDoS attacks, and Kamphuis has acted as an unofficial spokesman for the 'Stophaus' group behind the attacks - although, somewhat implausably, he denies any direct involvement.

CyberBunker is named after the disused NATO bunker from the Cold War era in the Netherlands, where it was once (and possibly still is) located. CyberBunker promises to host anything 'except child porn and anything related to terrorism', thus few will be surprised that it is a popular host for spammers, scammers and malware authors. It has also hosted a Wikileaks mirror and the website of torrent index The Pirate Bay.

For this latter reason, the provider has gained some popularity among the hacktivist community. This popularity may also have been fuelled by the spin Kamphuis has given to the story, where he tried to portray himself as an online Robin Hood, accusing Spamhaus in general and its founder Steve Linford in particular of wanting to control the Internet.

The attack on Spamhaus was said to be 'the biggest DDoS ever', and although some stories in the media about the iminent collapse of the Internet were somewhat inflated, it certainly was big. It disrupted both the website and the email infrastructure of the blacklist provider, although it didn't affect the DNS-based list itself. This led to the ironic situation where IP addresses could still be added to the blacklist, but removals could be delayed.

It is uncertain whether the arrest of Kamphuis means the DDoS attacks have now come to an end. Shortly after his arrest, some hacktivists posted an 'official' press release, in which they threaten more attacks if Kamphuis is not released. They also claim to be responsible for a series of DDoS attacks against Dutch banks and government websites in recent weeks, but this is probably to be taken with a pinch of salt.

More details at the blog of Brian Krebs here, with comments from Spamhaus's Steve Linford here. Meanwhile, the Dynamoo blog had a look at some of CyberBunker's IP space and found a significant part of it listed for spreading malware and/or spam.

Posted on 29 April 2013 by Martijn Grooten

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2021 localhost videos available on YouTube

VB has made all VB2021 localhost presentations available on the VB YouTube channel, so you can now watch - and share - any part of the conference freely and without registration.

VB2021 localhost is over, but the content is still available to view!

VB2021 localhost - VB's second virtual conference - took place last week, but you can still watch all the presentations.

VB2021 localhost call for last-minute papers

The call for last-minute papers for VB2021 localhost is now open. Submit before 20 August to have your paper considered for one of the slots reserved for 'hot' research!

New article: Run your malicious VBA macros anywhere!

Kurt Natvig explains how he recompiled malicious VBA macro code to valid harmless Python 3.x code.

New article: Dissecting the design and vulnerabilities in AZORult C&C panels

In a new article, Aditya K Sood looks at the command-and-control (C&C) design of the AZORult malware, discussing his team's findings related to the C&C design and some security issues they identified.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.