Ubisoft sues operators of four DDoS-for-hire services

January 20, 2020 TH Author

Gaming company Ubisoft has filed a lawsuit against five individuals for operating four DDoS-for-hire (DDoS booter) services that were used to launch DDoS attacks on Rainbow Six Siege multiplayer servers.

The legal complaint, filed last week, is the culmination of a months-long process that started back in September last year.

At the time, Ubisoft noticed a sharp increase in DDoS attacks targeting its Rainbow Six Siege (R6S) game. The reasons for the DDoS attacks was a new game update that just rolled out at the time, which also resulted in a reset of the global player ranking.

R6S players discovered that they could cheat their way up the new ranking by launching DDoS attacks on current matches and forcing their opponents to disconnect — earning unearned victories.

Faced with an onslaught of DDoS attacks that threatened the game’s availability for all R6S players, but also the company’s future profits, Ubisoft cracked down hard on the new phenomenon.

A week after the game’s launch, Ubisoft announced a slew of countermeasures that included server upgrades, a wave of bans for players who were caught using DDoS attacks, but also warned they planned to take legal action against DDoS-for-hire services that were facilitating the attacks.

Initially, the company’s efforts were ridiculed. However, almost six weeks later, Ubisoft said its countermeasures yielded impressive results, with the company reporting a drop of 93% in terms of DDoS attacks.

Ubisoft delivered on its threats

Last week, Ubisoft delivered on the legal threats it made in September against the operators of DDoS-for-hire services.

According to court documents, Ubisoft sued five individuals who the company believed were running a network of four DDoS-for-hire services.

The plaintiffs named in the lawsuit are Dennis Kruk (based in Germany), Maximilian Kuehl (Germany), Kelvin Uttih (Nigeria), an individual identified as B.R. (the Netherlands),and an individual identified only by their email address — apple.id12343@gmail.com.

Ubisoft said the five managed four DDoS-for-hire services: SNG.one, r6ddos.com, r6s.support, and stressed-stresser-stressing-stressers.com.

The game maker said the five earned “substantial revenue” by advertising their services to R6S players, offering DDoS-for-hire services for fees ranging from $11/month to $300 for lifetime access.

Ubisoft is now seeking to have the five charged and is also seeking financial relief for damages caused and costs incurred.

“Defendants’ conduct has forced Ubisoft to spend significant sums of money (and vast amounts of time) attempting to remediate the damage caused by the DDoS Services and DDoS Attacks,” the complaint said. “This includes employing new network and traffic management technologies that counteract the effects of Defendants’ DDoS Attacks, responding to player complaints, employing personnel to police the games to detect the use of the DDoS Services, reducing the number of R6S matches per server to mitigate the impact of DDoS Attacks, and ‘banning’ (i.e., permanently deleting the accounts of) users who are using the DDoS Services.”

Taunts lead to lawsuit

However, one might wonder why Ubisoft chose to go after these four particular services, as there are tens of DDoS-for-hire services available online that players have often used to launch attacks against the company.

One of the reasons is that the four services appear to have been specifically designed to attack Ubisoft’s R6S game.

According to a screenshot included in the legal complaint, one of the four sites included special DDoS attack modes for attacking R6S servers in particular.

Furthermore, another reason was that the plaintiffs often taunted official Ubisoft accounts about their ability to attack R6S servers and “repeatedly mocked Ubisoft’s security efforts,” bringing the company’s gaze upon their criminal activities.

Probably not a smart move on their part.