Cyber Incident Victim: VoIP.ms
Date:
Sep 2021
Location:
Canada
Summary
A voice-over-IP provider suffered a disruptive DDoS attack targeting its DNS infrastructure, severely impacting telephony services and preventing customers from making or receiving calls. Mitigation attempts, including advising clients to modify HOSTS files and migrating to Cloudflare, were partially successful but services remained intermittently affected as attacks continued. Threat actors impersonating the REvil ransomware group claimed responsibility, initially demanding one bitcoin and later escalating to 100 bitcoins to halt the attacks. The incident caused prolonged service disruptions, including dropped calls, performance degradation, and inability to forward lines, while customer reactions varied between urging payment and supporting resistance against the extortion.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On September 16, 2021, VoIP.ms, a global provider of voice-over-IP services, experienced a distributed denial-of-service (DDoS) attack targeting its infrastructure, including DNS name servers. The attack disrupted telephony services for customers who relied on the company’s domain name for configuring VoIP equipment, preventing them from making or receiving calls. In response to DNS failures, VoIP.ms advised customers to modify their HOSTS files to bypass DNS resolution by pointing directly to the company’s IP address. This mitigation strategy proved ineffective, as threat actors subsequently redirected DDoS attacks toward the IP address itself. VoIP.ms transitioned its website and DNS servers to Cloudflare to counter the assaults, achieving partial success, though service interruptions persisted due to ongoing attacks. By September 20, customers continued reporting operational issues, including dropped calls, service outages, performance degradation, and failures in call forwarding.
On September 18, a threat actor using the name “REvil” claimed responsibility for the attack and linked to a Pastebin ransom note demanding one bitcoin (approximately $45,000 at the time) to halt the DDoS campaign. The note was later removed from Pastebin. The attackers subsequently escalated their demand to 100 bitcoins (roughly $4.3 million). Security analysts noted REvil’s lack of historical association with DDoS extortion, suggesting the attackers were impersonating the ransomware group to intensify pressure on VoIP.ms. Customer reactions diverged, with some urging the company to pay the ransom to restore services and prevent further client losses, while others advocated against capitulation. VoIP.ms maintained public updates acknowledging the attack’s persistence and its team’s mitigation efforts but did not disclose whether ransom negotiations occurred. Service disruptions remained unresolved as of the latest reporting date.