Runbox is under attack by extortionists

October 23, 2021 32 Comments

On Friday evening Norwegian time, Runbox started experiencing Distributed Denial of Service (DDoS) attacks by extortionists demanding that we pay them an amount of Bitcoin to stop the attacks.

The attacks consist of a massive volume of data traffic, in excess of 50 Gbps, to our service that overwhelm our servers and intermittently block our customers from accessing our services.

Runbox has persevered against similar DDoS attacks in the past and never in our history paid criminals who attack our services. And we are not going to start now.

Paying extortionists would provide no guarantee that further attacks would be prevented, and could instead make the victim more attractive for similar attacks. Furthermore, funding such criminal activities would only increase the likelihood of further attacks by the same criminals or other malefactors.

Since these DDoS attacks started we have worked with our system administrators and Internet Service Provider to mitigate the attacks. We are considering further mitigation options and appreciate the offers we have received from DDoS mitigation specialists who wish to help.

We have also learned that Runbox is not alone in being attacked, as The Record reports that Fastmail and Posteo are also under attack by the same extortionists.

Anyone who is experiencing DDoS attacks is encouraged to never capitulate. Let us instead coordinate our fight against these criminals and fully cooperate with relevant law enforcement in our respective countries.

We also encourage our respective customers to continue supporting independent email services such as the three of us now under attack. We thank you for your patience and understanding while we fight to regain your access to our services.

We will keep you updated on our Service Status page and assure you that we are doing everything in our power to restore services for you.

The full extortion letter is pasted below.

From: Cursed Patriarch
Posted on: 22 Oct 2021 – 15:56
Email: ravid.grossman@nullprotonmail.com

Subject: EXTORTION: DDoS attack

Hi,

I will start 1-2 hours attack on your site. It will not be hard as I don’t want to impact your business now. Just check your logs to see that I’m for real.

Pay me 0.06 BTC to 3GBAUXHmfxideRQWqRagtQRznB2GdUuMkfand I will never attack you again.

If you don’t pay within until Monday, total shut down is coming, cheap protection will not help my fee will increase and if you refuse you will lose much more then that.

Pay 0.06 now to prevent suffering.

Best regards,
Cursed Patriarch

P.S. This is disposable email. Do not reply.

Continue Reading →

DDoS Attacks on Runbox

November 5, 2015 11 Comments

Yesterday and today Runbox was subject to Distributed Denial of Service (DDoS) attacks. This was initiated by a group that have threatened that if Runbox does not pay them a large amount of money, further attacks will take place in the coming days.

We were able to successfully mitigate against the effects of both incidents. During the initial attack we were down for around 15 minutes before we could put a solution in place. Today our customers should not have noticed any effects of the attack.

We think the attacks might be scaled up in the coming days.

(more…)

Continue Reading →

More details about last night’s DDoS attack

January 25, 2013 2 Comments

In the early hours of 25th January the Runbox network was subject to a Distributed Denial of Service attack. This sort of attack uses multiple computers around the world to flood our servers with requests and this makes it difficult, if not impossible, for legitimate access by our customers.

Response and consequences

We were quick to respond to this problem, but it can take some time to identify the multiple sources of the attack and then block the traffic to our servers. As a result of the attack many of you would not be able to access our services during the time it was taking place.

The attack was carried out by a group who had previously failed to get access to some of our customers accounts that do not belong to them. They had threatened to carry out the attack if we did not comply with their wishes.

No data was compromised

We would like to assure our customers that no customer data was compromised before, during or after the attack, and that we would never give way to such threats. If you have any concerns about this incident, please open a support ticket at https://support.runbox.com

Continue Reading →