Ransom DDoS: why paying does not end the threat at all

That last row is the honest framing. No product resolves an extortion attempt. What defences do is remove the lever the demand relies on.

A threat with nothing behind it. A message announcing an attack on a future date unless payment arrives. Sending these costs nothing and they can be sent to thousands of organisations at once, so the sender does not need any capability for the approach to be profitable. Most recipients of this kind never see an attack.

A demonstration followed by a demand. A short burst of traffic, enough to be noticed, then a message referring to it. This is more serious, because capability has been shown, though the size of a demonstration says little about what can be sustained.

A demand during an ongoing attack. The pressure is real and immediate, and it is also the situation where a decision made in the first hour is most likely to be wrong.

Four questions separate a bulk message from a targeted one.

Is anything specific to you in it? Bulk extortion mentions no detail that could not be scraped: your domain, an industry, a generic sum. Targeted messages reference infrastructure the sender had to look at.

Was anything demonstrated? A claim with no traffic behind it is a claim about the future made by someone with an incentive to exaggerate.

Is the timeline structured to prevent thinking? Short deadlines and escalating penalties are a pressure technique rather than an operational necessity.

Does the same message exist elsewhere? Bulk campaigns are widely reported, and the text is often identical between recipients. Checking whether others received the same message costs nothing and settles most cases.

Four reasons, and they hold regardless of what the message promises.

Nothing is delivered in exchange. There is no product being sold. A payment buys a promise from an anonymous party with no obligation and no reputation to protect, and the only enforcement available to you is hoping.

It identifies you as someone who pays. That information has value to the recipient and to anyone they share it with. Organisations that pay are approached again, sometimes by different parties, sometimes with the previous payment cited as evidence that the approach works.

It funds the capability being used against you. Extortion continues because it is profitable, and each payment sustains the infrastructure that makes the next threat credible.

It changes nothing about your exposure. Whatever made you a viable target still applies the day after the payment clears. The absence of an attack afterwards is indistinguishable from an attack that was never coming.

There is also a legal dimension that depends entirely on where you are and who the recipient turns out to be. Payments to sanctioned parties carry consequences separate from anything in the threat itself, which is a question for a lawyer before it is a question for an engineer.

Five steps, in order.

Do not reply. A response confirms the address is live and the recipient is engaged, which is the qualifying signal a bulk campaign is looking for.

Preserve the message. Full headers included. It is evidence, and it is also what lets anyone else determine whether the campaign is known.

Tell whoever carries your traffic. Your connectivity provider and any platform in front of you can prepare capacity and filtering before a deadline rather than during an incident. This is the single most useful call to make.

Report it. Extortion is a criminal matter in most jurisdictions, and reports are how bulk campaigns get identified as bulk.

Check what would actually happen. The deadline is a free opportunity to review capacity, rate limits, and whether anyone knows who to call. That work has value whether or not anything arrives.

The useful posture is unglamorous and mostly consists of decisions made in advance.

Know where traffic terminates and who can absorb volume, because the answer determines whether an attack is your problem or your provider's. Know which of your endpoints are expensive, since those are what an application-layer attack will find. Have a way to reach the people who can act outside working hours, and agree beforehand who decides.

And decide the payment question now, in writing, while nobody is under pressure. A policy written calmly is what prevents a decision made at three in the morning by whoever happened to be awake.

The demand is not a technical event, and the traffic behind it is ordinary traffic belonging to one of the families described on DDoS attack types. Defence is therefore the same as it would be without the message: capacity for what saturates links, connection handling for what exhausts state, and request limits for what exhausts the application.

Bridge WAF covers the last of those: requests are inspected before reaching your origin, and rate limiting is applied per domain. Because traffic terminates at the edge, the capacity in front of you is the platform's rather than your link's. What no product provides is a resolution to the extortion itself, and any that claims to is selling something else. See what the platform offers at Bridge CDN.