Avatar

Back in March, Seth Hanford wrote about a distributed denial of service (DDoS) attack aimed at the SpamHaus organization. Since then, there have been some new developments in the aftermath of the DDoS attack, most notably the arrest of the attackers’ spokesperson, Sven Olaf Kamphuis.

Update

On April 26, Kamphuis, STOPhaus activist and possibly the person behind the large-scale SpamHaus DDoS attacks, was arrested in Spain. He had allegedly been operating out of his van, which he had transformed into a mobile computing office.

sven-olaf-png

Photo by Kamphuis (Kamphuis Facebook Page)

The STOPhaus Twitter account had incidentally ceased tweeting for a week prior to Kamphuis’ arrest, beginning April 20. However, after the arrest the STOPhaus twitter account came back to life, firing off several tweets using the hashtag ‪#free‪CB3ROB, and declaring that Kamphuis is only a STOPhaus spokesman and not the perpetrator of the DDoS attacks that topped 300 Giga baud. A separate Pastebin entry posted April 26 threatens additional attacks if Sven Kamphuis is not released.

tweets-png

Screen shot by Jaeson Schultz

Now that Kamphuis has been arrested, it puts the claims that he is merely a STOPhaus spokesman to the test. Already, the STOPhaus Twitter account has come back to life, but if we also see additional DDoS attacks in retribution for Sven’s arrest, then it may signal that a larger criminal gang is behind the attacks.

References:

http://www.elmundo.es/elmundo/2013/04/28/navegante/1367139728.html

http://pastebin.com/qzhcE1nV



Authors

Jaeson Schultz

Technical Leader

Cisco Talos Security Intelligence & Research