RDoS: When DDoS Becomes Extortion

RDoS (Ransom Denial of Service) is the extortion variant of the DDoS attack: criminals threaten a massive attack on your infrastructure and demand a payment - often in cryptocurrency - not to carry it out or to stop it.

How an RDoS extortion unfolds

1. 1Threat: you receive an email announcing an attack and demanding a ransom by a deadline.
2. 2Demo attack: to back it up, a short, targeted attack often follows as a 'taster'.
3. 3Escalation: if you don't pay, the perpetrators threaten larger, longer attacks.

BSI 2021 Situation Report: DDoS extortion

Should you pay?

No. Payment guarantees neither an end to the attack nor protection from further demands. Germany's Federal Office for Information Security (BSI) generally advises ransomware victims not to engage with extortion demands or pay a ransom. RDoS uses a different technical attack method but follows the same extortion logic: involve legal counsel and law enforcement while activating technical mitigation.

BSI: First aid for a serious IT security incident

How to prepare

• Enable network-level mitigation, ideally with an always-on option.
• Keep an escalation and communication plan ready (who decides, who informs).
• Ensure capacity headroom and 24/7 support with your upstream.
• Document the threat and report the incident to the authorities.

Conclusion

Document threats, maintain contact with your upstream and check service reachability during mitigation. Technical preparation reduces risk but does not guarantee that an attack has no impact.