Cyber Incident Victim: World of Tanks
Date:
Jan 2014
Location:
United States of America
Summary
A series of DDoS attacks disrupted multiple online gaming platforms, including World of Tanks, Steam, Origin, Battle.net, and League of Legends, temporarily taking their servers offline. The hacker group DERP Trolling claimed responsibility for several attacks, utilizing a tool dubbed the "Gaben Laser Beam," and solicited target requests via a public phone number. These incidents were linked to harassment against a streamer following a swatting attack that resulted in police intervention at his residence. While DERP denied involvement in the personal aspects of the harassment, the coordinated disruptions highlighted the targeting of gaming infrastructure amid online vendettas. Affected services resumed normal operations following the attacks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In early January 2014, multiple online gaming platforms, including World of Tanks, experienced temporary server disruptions due to distributed denial-of-service (DDoS) attacks. A group identifying itself as DERP Trolling claimed responsibility for these attacks through Twitter, citing the use of a tool they dubbed the "Gaben Laser Beam," a reference to Valve founder Gabe Newell. The attacks occurred over several days, initially targeting Battle.net, League of Legends, EA.com, and World of Tanks earlier in the week, followed by subsequent disruptions to Steam and Origin services overnight on January 2-3. DERP Trolling publicly acknowledged their role in the Origin attack and referenced prior strikes against other platforms, though they denied involvement in related harassment campaigns. The group provided a phone number for third parties to submit target requests, suggesting their actions may have been influenced by external actors.
These incidents were linked to a broader harassment campaign against YouTube streamer PhantomL0rd, whose personal information had been leaked online. Attackers initially focused on disrupting games PhantomL0rd streamed for revenue, escalating to a swatting incident where police forcibly entered his home. While DERP Trolling distanced itself from the swatting, their DDoS activities coincided with this vendetta, marking one of the first instances where major gaming infrastructures became collateral damage in a targeted harassment effort. All affected services, including World of Tanks, resumed normal operations by the morning of January 3. The attacks highlighted vulnerabilities in gaming platforms' infrastructure and demonstrated how personal disputes could disrupt commercial online services at scale, though no specific mitigation measures or organizational responses were detailed in available reports.