Alfa-Bank

Summary

A hacker using the alias vimproducts claimed responsibility for distributed denial-of-service (DDoS) attacks targeting multiple Russian financial institutions, including Alfa-Bank, during a high-profile election period. The attacks temporarily disrupted access to several banking websites, with three remaining inaccessible approximately an hour after the assaults began. The perpetrator stated the attacks were commissioned by clients motivated by Russia's alleged interference in the election, while simultaneously promoting his DDoS-for-hire services through media outreach. He criticized the affected institutions for inadequate cybersecurity protections, noting their vulnerability to relatively low-cost attacks ranging from $25 to $150 daily depending on target complexity. The incident highlighted both operational security weaknesses and the attacker's deliberate use of timing for maximum publicity impact.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 8, 2016, coinciding with the U.S. presidential election, a hacker using the alias vimproducts conducted distributed denial-of-service (DDoS) attacks against multiple Russian financial institutions, including Alfa-Bank. The attacker contacted Motherboard journalists to document the incidents, demonstrating real-time disruptions to the Moscow Exchange, Bank of Moscow, Rosbank, and Alfa-Bank websites. After sharing functional links to these sites, vimproducts executed attacks that rendered them either unresponsive or completely offline. Approximately one hour after the attacks began, three of the four targeted websites remained inaccessible. The hacker also attempted to disrupt the Russian Ministry of Economic Development’s website but failed despite multiple efforts. Vimproducts operated through AlphaBay, a dark web marketplace, offering DDoS-for-hire services priced at $25 or $150 daily depending on target size and security measures.

The attacks were commissioned by clients motivated by Russia’s alleged interference in the U.S. election, as stated by vimproducts. He explicitly linked the timing to Election Day, acknowledging it served as strategic publicity for his services while damaging Russia’s reputation. The hacker criticized the targeted banks for inadequate DDoS protections, asserting their security flaws made the disruptions easier to achieve. No financial demands or data breaches were reported, and the primary impact was temporary service unavailability. Vimproducts actively sought media coverage by soliciting journalists, though Motherboard declined to publish his contact details. The incident highlighted operational vulnerabilities in the affected institutions’ web infrastructure without evidence of data compromise or collateral damage beyond temporary outages.

Sources

Sources available to members: 1 source.