# Ransom DDoS (RDoS): When Extortionists Use Traffic as a Weapon > DDoS-for-extortion campaigns follow a predictable playbook: a warning email, a demonstration attack, a Bitcoin demand. Here's how to respond — and why paying never works. - Category: Attack Analysis - Author: Akarguard Team, Security Engineering - Published: Sep 13, 2026 - Canonical: https://akarguard.net/blog/ransom-ddos --- Ransom DDoS — RDoS, or DDoS extortion — is one of the simplest criminal business models on the internet: threaten to flood a target unless they pay, and collect from the ones who panic. It works because even organisations with reasonable security often have no real answer to a 300 Gbps flood promised for tomorrow morning. The whole scheme runs on fear and a deadline, which is exactly why understanding the playbook defuses most of it. ## The Standard Playbook - A threatening email arrives, usually claiming to be a famous group ('Fancy Bear', 'Lazarus Group') — the attribution is almost always fake. - A short demonstration attack, typically 10–30 minutes, is launched to prove the threat is real. - A Bitcoin demand follows, often 1–5 BTC, with a tight deadline designed to prevent calm decision-making. - Either a follow-through attack if unpaid — or, very often, nothing at all, because a large share of these threats are pure bluff. ## Why You Should Never Pay - Paying marks you as a payer, which guarantees more demands from the same and other groups. - The demand frequently escalates immediately after the first payment lands. - Your money funds the infrastructure used to attack the next victim. - There is no guarantee the attacks stop — criminals do not honour agreements. > **Resilience is the only deterrent** — An RDoS crew is running a numbers game. If their demonstration attack causes no disruption, you are not worth their time — they move to a softer target. Demonstrated resilience, not payment, is what makes them go away. ## The Correct Response When an RDoS threat arrives, do four things and skip the panic. Make sure your traffic is already routed through protection before any attack begins — not during it. Preserve the email and its headers for law enforcement. Report it to your national CERT. And file a police report, which insurers and prosecutors will later want. If your infrastructure is already behind protection, the demonstration attack simply fails, and with it the attacker's entire leverage. ## How Akarguard Removes the Leverage Akarguard's value against RDoS is that it turns the demonstration attack into a non-event. With your domain already routed through the reverse-proxy edge, application-layer floods are filtered, your origin IP is hidden so it cannot be targeted directly, and automatic mitigation escalates protection the moment the demo begins — no human decision required at the worst possible hour. When the attacker's proof-of-capability produces no visible disruption, the negotiation is over before it starts. Set it up before the threat arrives, because the one thing you cannot do is provision protection faster than a deadline you did not choose. --- Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.