MegaMedusa: The DDoS Tool Taking the Hacker World by Storm

The pro-Palestinian and pro-Muslim Malaysian hacktivist group RipperSec, established in June 2023, has amassed over 2,000 subscribers on its Telegram channel. 

Collaborating with international groups like Tengkorak Cyber Crew and Stucx Team, RipperSec engages in cyberattacks such as data breaches, website defacements, and distributed denial-of-service (DDoS) attacks. 

Their primary targets are countries perceived as supporting Israel, aiming to disrupt operations, draw attention, and express solidarity with Palestinian and Muslim causes.

RipperSec, a cybercrime group, claimed responsibility for 196 DDoS attacks targeting Israel, India, the US, the UK, and Thailand between January and August 2024. 

MegaMedusa, a publicly available Web DDoS attack tool developed by RipperSec, was used to carry out these attacks. Executed using Node.js, it leverages its asynchronous and non-blocking I/O capabilities to efficiently manage multiple network connections, making it a potent weapon for large-scale DDoS attacks. 

It primarily targeted government, educational, business, and financial websites, demonstrating a preference for critical infrastructure.

MegaMedusa employs a variety of randomization techniques to obfuscate its attack requests, making them difficult to detect and mitigate, including randomizing headers, request paths, methods, cookies, IP addresses, TLS/SSL configurations, HTTP/2 settings, and proxy usage. 

Additionally, the tool supports open proxies and provides scrapers to obtain fresh lists of proxies from publicly available sources, which makes MegaMedusa a potent tool for launching distributed denial-of-service (DDoS) attacks.

MegaMedusa, a DDoS attack tool, claims to bypass security challenges, including CAPTCHAs, but its implementation is limited, which primarily relies on randomization and proxy use to avoid detection rather than solving CAPTCHAs directly. 

While it includes some basic CAPTCHA handling elements, it lacks advanced capabilities like machine learning or browser automation. The RipperSec group is likely using more sophisticated custom versions of MegaMedusa, as evidenced by their advertisement video.

Web DDoS attacks utilize proxies to conceal the origin of requests and bypass detection mechanisms. Proxies act as intermediaries, establishing a TCP connection with the target and forwarding requests. 

Node.js libraries like https-proxy-agent simplify proxy implementation, but MegaMedusa uses a native approach for greater control, which allows attackers to generate high volumes of requests from various locations, overwhelming targets and disrupting services.

HTTP protocol improvements, like pipelining and multiplexing, have increased attack efficiency. While pipelining is limited by head-of-line blocking, multiplexing offers concurrent requests over a single TCP connection. 

Vulnerabilities like HTTPS/2 Rapid Reset and HTTP/2 Continuation have exploited these improvements for DDoS attacks. Open and commercial proxies, often compromised residential devices or servers, provide attackers with residential IP addresses, avoiding detection. 

According to Radware, commercial proxies offer features like daily rotating IP addresses to evade blocking. Free proxy lists are available online, including from the IT Army of Ukraine’s IT Army Kit.

Advanced DDoS attackers are increasingly leveraging cloud-based infrastructure to enhance scalability, reliability, and ease of management and also exploit botnets, particularly IoT botnets, for distributed attacks and to provide proxy and SOCKS services. 

Attackers often combine both approaches, creating hybrid infrastructures that can launch diverse and powerful attacks, making DDoS attacks more sophisticated and harder to mitigate.

Also Read:

Hackers Exploited Misconfigured AWS .env Files to Attack 110,000 Domains