At 02:14 on a Tuesday, a regional payments processor received a ransom note naming three public ASNs and a deadline aligned with the next ACH batch window. The on-call engineer opened the upstream ticket portal, saw green SLA markers on the transit circuits, and assumed the carrier would absorb whatever came next. Forty minutes later, customers reported failed checkouts while the edge firewall session table climbed past 85 percent. The scrubbing center was still waiting on a signed change order that legal had parked after the last budget cycle. By the time diversion engaged, the attacker had already shifted from a UDP reflection burst to a slower HTTPS flood against the login and status APIs. The board later asked why a high-profile conviction for telecom-related extortion had not translated into a rehearsed response.
That question sits behind a convenient myth: when courts sentence people who extorted carriers such as AT&T and Verizon, enterprises treat DDoS readiness as someone else's closed case. Prosecutions matter. They do not replace contracts, authority, telemetry, or drills that fire under time pressure.
Why convictions and contracts live on different clocks
Recent reporting on a U.S. service member sentenced to 70 months for AT&T and Verizon extortions reinforces a real enforcement signal. Extortion against critical communications brands draws federal attention. Operators who plan ransom-backed floods still shop for soft targets with weak diversion authority, stale runbooks, and origins that sit one hop behind a single transit provider.
Threat traffic that fuels those floods often shares infrastructure with other abuse campaigns. Compromised residential and camera peers, cracked remote-access tools, and malware droppers from torrent-driven waves such as MovieReaper all expand the pool of disposable sources. Your mitigation plan has to assume source churn measured in minutes, not attribution that waits on court calendars.
Failure pattern worth drilling before earnings week
A concrete pattern keeps repeating in mid-market and multi-homed environments:
- Ransom note first. The note references prior outages at peer firms, attaches a small proof-of-capability burst, and sets a payment window inside a business-critical interval.
- Volumetric open, application follow-through. Reflection or carpet-bombing saturates the under-provisioned uplink. When scrubbing finally engages, the campaign pivots to L7 against auth, search, or export endpoints.
- Authority gap. No pre-authorized person can order diversion, raise ASN-level caps, or approve origin shielding without a midnight bridge that includes legal, the ISP, and the CDN account team.
- False recovery signal. Transit graphs flatten while application error rates, queue depth, and origin connection budgets remain degraded.
Teams that treat the prosecution news cycle as reassurance often skip the dull work that would have shortened that timeline: named mitigation owners, tested BGP communities, and application health checks wired into the same channel as the flood bridge.
Build a response that survives vector changes
1. Pre-authorize diversion the way you pre-authorize incident spend
Write a short mitigation authority matrix that names who can trigger scrubbing, blackhole a /32 or /128 for sacrificial services, raise WAF sensitivity, and freeze nonessential publish windows. Store carrier change IDs, CDN support PINs, and out-of-band contacts in the same sealed packet the SOC already uses for ransomware. Rehearse the first fifteen minutes with a stopwatch, including the handoff from NOC to application owners.
Tradeoff: Broad authority speeds response and increases the chance of an over-aggressive block that hurts a partner API. Mitigate that risk with scoped playbooks per service tier rather than a single "kill traffic" switch.
2. Separate volumetric absorption from application survival
Capacity at the scrubber protects the pipe. It does not automatically protect session-heavy login flows or chatty mobile APIs. Pair always-on or on-demand scrubbing with origin connection budgets, per-endpoint rate policies, and synthetic checks that exercise the same URLs customers hit during checkout or status polling.
During a flood, require three converging signals before you declare recovery: scrubber drop and pass rates inside expected bands, origin keep-alive and TLS handshake success above baseline, and authentic user transaction completion (not just HTTP 200 on a static health file).
Caveat: Aggressive L7 challenges can strand accessibility tools and break headless partner integrations. Maintain allowlists for known automation with mutual TLS or signed headers, and document who owns exceptions during an event.
3. Treat multi-homing as a control plane problem
If you announce the same prefix to two providers, decide in advance which upstream receives the scrubbing announcement, how you withdraw from the saturated path, and how DNS TTLs interact with anycast or CDN failover. Practice a controlled shift during a maintenance window so the first real extortion note is not also your first BGP experiment.
Tradeoff: Faster DNS TTLs improve failover agility and increase query load on authoritative servers that attackers may also target with water-torture style query floods. Size authoritative capacity and consider anycast DNS as part of the same program.
4. Keep hunt and mitigate on one timeline
Sustained floods often coincide with credential stuffing, VPN probing, or GPO-stage ransomware preparation elsewhere in the estate. While the edge team diverts traffic, identity and endpoint owners should review admin creation, remote support paths, and unusual outbound peers. Hybrid campaigns compress both clocks; your bridge agenda should list edge mitigation and lateral checks as parallel tracks with explicit owners.
Implementation details that hold up under stress
- Baseline now. Capture peak legitimate RPS, concurrent sessions, and 95th percentile origin concurrency per critical endpoint for the last 30 days. Flood decisions without baselines turn into guesswork.
- Instrument the join. Correlate scrubber flow logs, WAF rule hits, firewall session counts, and application RED metrics (rate, errors, duration) in one view the incident commander can read without tab hopping.
- Pre-stage sacrificial hostnames. Marketing microsites and legacy vanity domains make cheap proof-of-capability targets. Know which names you can null-route without touching revenue paths.
- Contract for burst, not average. Scrubbing and CDN commitments sized to quiet Tuesdays fail on the day an extortion crew rents a reflection botnet. Review commit-versus-burst language annually with finance present.
- Close the IPv6 gap. Dual-stack services that only rehearse IPv4 diversion leave an escape hatch. Apply the same diversion, ACL, and logging expectations to IPv6 prefixes.
A short field checklist for the next ransom note
- Acknowledge the note in the incident system; do not negotiate on the same channel used for production changes.
- Activate the named mitigation owner and open the carrier or CDN bridge with pre-staged credentials.
- Divert volumetric traffic; simultaneously tighten L7 controls on auth and export APIs.
- Verify recovery with transaction and origin signals, then schedule a controlled diversion teardown with a watch window.
- Hand the SOC a parallel hunt list for admin paths, remote support, and new outbound peers during the flood window.
- Within five business days, update the authority matrix and fix any contract or TTL weakness the event exposed.
What "good" looks like after the headlines fade
Court outcomes against people who extorted major carriers raise the cost of that crime for individuals. Your organization still needs a flood runbook that assumes disposable botnets, vector switches mid-incident, and business deadlines chosen by the attacker. The practical standard is simple: a named person can divert traffic within minutes, application owners can prove real user recovery, and the rest of security keeps hunting while the pipe is noisy.
If your current plan still depends on a hopeful ticket to the ISP and a static health check, treat the next quiet week as the rehearsal window. Extortion crews already schedule around your busy ones.
