Cyber Threat Actor: VDoS

VDoS, also known as VBooter, is a threat actor linked to disruptive distributed denial-of-service (DDoS) attacks against high-profile online platforms and gaming services. Public reporting associates this actor with targeting widely used internet infrastructure and entertainment services, causing intermittent outages that impact global user access. The actor's operations demonstrate a focus on maximizing visibility through attacks against entities with large, international user bases, though specific organizational structure or operational scale remains undocumented in available sources.

This threat actor’s confirmed targeting centers on online knowledge repositories and multiplayer gaming platforms, with Wikipedia and Blizzard’s World of Warcraft Classic servers identified as victims in September 2019. Geographically, these attacks primarily disrupted services across Europe—including the United Kingdom, Poland, France, Germany, and Italy—and parts of the Middle East. Strategic objectives appear aligned with service disruption rather than financial extortion or data theft, as evidenced by the temporary takedown of platforms without explicit ransom demands. The sole publicly cited TTP involves large-scale DDoS attacks, though technical specifics regarding attack vectors, tooling, or infrastructure are not detailed in available reporting. A Twitter account using the name “UkDrillas” claimed responsibility for the 2019 attacks against both Wikipedia and World of Warcraft Classic, leading to the public identification of at least one alleged UK-based individual through doxxing efforts by affected parties. No verifiable affiliations with state actors or organized criminal groups have been established in open-source materials related to these incidents. The 2019 campaign against Wikipedia drew attention for impairing access to a critical information resource, prompting condemnation from the Wikimedia Foundation for undermining free access to knowledge. Concurrent attacks on World of Warcraft Classic disrupted gameplay for a dedicated user community, reflecting a pattern of targeting services with emotionally invested audiences to amplify disruptive impact. Historical context notes prior DDoS attacks against World of Warcraft servers by unrelated actors, but no further campaigns are explicitly attributed to VDoS/VBooter beyond the 2019 events.