Empty DDoS Threats: Meet the Armada Collective

BELGRADE - Beginning in March 2016, Cloudflare team began hearing reports of a gang of cybercriminals once again calling themselves the Armada Collective. The calling card of the gang was an extortion email sent to a wide variety of online businesses threatening to launch DDoS attacks if they weren't paid in Bitcoin.

More than 100 existing and prospective CloudFlare customers had received the Armada Collective's emailed threats. According to Cloudflare, they have also compared notes with other DDoS mitigation vendors with customers that had received similar threats.

Their conclusion was a bit of a surprise: Cloudflare has been unable to find a single incident where the current incarnation of the Armada Collective has actually launched a DDoS attack. In fact, because the extortion emails reuse Bitcoin addresses, there's no way the Armada Collective can tell who has paid...