Security firm Forcepoint discovered the competition and they called it “Gamification” of DDoS attacks. According to Forcepoint, each participant in the contest receives access to a tool which is known as “Balyoz” which is also a Turkish word for Sledgehammer which allows them to launch DDoS attack against selected websites from a single machine. Participants are then rewarded for their achievements and the longer they run the DDoS application, the more points they get. The points can be redeemed for various online click-fraud and hacking tools Forcepoint explains “For every ten minutes spent attacking one of these websites, users receive points that can be traded in for rewards, such as a stand-alone version of the Sledgehammer DDoS tool and ‘click-fraud’ bots used to generate revenue on pay-to-click (PTC) sites. There is even a live scoreboard so participants can see their point rank” The competition is been promoted on Turkish Hacking forums and the competition is mostly aimed at political sites related to the Kurds, The German Christian Democratic Party- which is led by Angela Merkel- and the Armenian Genocide, and others. What’s more interesting is that the tools that attacker receive are infected with backdoor which only activates once the user participating is out of the competition “The backdoor is a very small trojan and its sole purpose is to download, extract and execute another .NET assembly from within a bitmap image. It also downloads a secondary ‘guard’ component which it installs as a service. This ‘guard’ component ensures that if the backdoor is deleted then it will be re-downloaded and also installed as a service”- Forcepoint explains. Turkish hacker is trying to compromise the computers of other hackers in order to form his own botnet that can be used to launch large-scale DDoS attacks. It is not yet clear how many attacks already launched and whether any website was impacted. However, Forcepoint mentioned that they will continue to monitor the activity and will report back with further updates.
