[ SECRET POST #6030 ]

[case]

⌈ Secret Post #6030 ⌋

Warning: Some secrets are NOT worksafe and may contain SPOILERS.


01.



__________________________________________________



02.



__________________________________________________



03.



__________________________________________________



04.



__________________________________________________



05.



__________________________________________________



06.


























Notes:

Secrets Left to Post: 01 pages, 25 secrets from Secret Submission Post #862.
Secrets Not Posted: [ 0 - broken links ], [ 0 - not!secrets ], [ 0 - not!fandom ], [ 0 - too big ], [ 0 - repeat ].
Current Secret Submissions Post: here.
Suggestions, comments, and concerns should go here.

Comments

[(Anonymous)]

DownForEveryoneOrJustMe (https://downforeveryoneorjustme.com/) is informing me that the AO3 has been out of comission for the past two hours, and still is. Thought it was worth commenting on here, and seeing if anyone knows what's up or has had similar problems recently.

[(Anonymous)]

No idea what’s up, but it’s been down for me too.

[(Anonymous)]

It took longer than usual to load a page, but it did work for me when I tried just now. So I’m not sure what it’s about.

[(Anonymous)]

AYRT

Seems like it's up for me, again, too. I got to the end of a fic and clicked the comments button and nothing happened. Putting the link in a different tab got me a 503 error, but it wasn't until I went to a poke-this-site-and-tell-me-if-it's-down page that I knew for sure. They don't exactly communicate clearly what's wrong.

Glad it's back, in any case.

[kaijinscendre]

It has been up and down since around 9am CST. It seems to be up currently. Some people are saying DDOS attack but the evidence is spotty in that regard.

[(Anonymous)]

That's what I've heard but my source is a tumblr post sooooo..... I wonder what it really is.

[(Anonymous)]

This is a great site, thank you for including the link.

[(Anonymous)]

AYRT

Sure thing! I've found that site very useful. And the name sticks in my head, so even though there's several places that do the same thing, I always go there. They've been around for over a dacade, by now.

[(Anonymous)]

It's been down for most of the day. AO3 status on twitter says it's a DDoS attack. From what I understand, a MAGA group has claimed responsibility but obvs the screenshots of that could be faked and I don't have a twitter account.

[(Anonymous)]

AYRT

Maybe it was a partial outage? Because I was trying to assemble some links for the person who requested dark fic pairing recs in yesterday's thread, and was making good time until around 21 UTC. (Coordinated universal time.)

I don't have a Twitter either, so I'm going to let that be for now.

[(Anonymous)]

I'm sorry but I doubt MAGA groups even know what Ao3 is given that most of them barely seem to understand the internet outside of using twitter.

Is there a place for ao3 news or updates?

[(Anonymous)]

I think they used to be active on twitter but I don't have an account and haven't been able to access twitter for awhile. Anyone know of another place to monitor for general status updates?

Re: Is there a place for ao3 news or updates?

[(Anonymous)]

Apparently, they have a tumblr - https://ao3org.tumblr.com/
Also, Reddit has an unofficial sub and people have been pretty good at updating others there - https://www.reddit.com/r/AO3/

[philstar22]

It is currently working for me.

[(Anonymous)]

According to Telegram screenshots, a Russian funded cyberterrorist group calling themselves "Anonymous Sudan" have taken responsibility for the DDoS. Their stated motive is to take down AO3 because it is an American website with NSFW and LGBT material on it.

I found this editorial by Cyber News very illuminating: https://cybernews.com/editorial/anonymous-sudan-explained/

Microsoft Outlook, UPS, and Scandinavian Airlines all fell victim recently to attacks by the group known as Anonymous Sudan. However, experts we’ve spoken to believe the group is most likely a pro-Kremlin pet project for spreading a pro-Russian agenda.

Anonymous Sudan has been difficult to avoid recently. The group’s successful distributed denial-of-service (DDoS) attacks disrupted the website of Scandinavian Airlines (SAS) and even took down Microsoft 365 software suite, including Teams and Outlook.

While the gang is supposedly an anti-Western pro-Islam hacker collective, the group’s origins and modus operandi strongly point to Anonymous Sudan being a “Made in Russia” project with the kind of solid financial backing that regular hacktivists can seldom afford.

“KillNet are likely running this for someone else who is paying them. Since everything Anonymous Sudan does seems to fit the Kremlin’s narrative, we assume that it comes from Russia and is [supported by] someone in the Russian government, or at least someone in the sphere around the Russian leadership,” Mattias Wåhlén, a threat intelligence expert at Truesec told Cybernews.

Where did Anonymous Sudan come from?

Anonymous Sudan surfaced as a Russian-speaking Telegram channel in mid-January of this year. The gang took the moniker of a 2019 hacking operation by the original Anonymous collective, whose members quickly distanced themselves from the newcomer.

Initially, the group tried to capitalize on the furor surrounding instances of desecrating the Quran, which would fit the narrative of outraged hacktivists from a primarily Muslim country.

However, there’s also no provable link between Anonymous Sudan and the country of Sudan, Jeffrey Bardin, the chief intelligence officer at Treadstone 71, told Cybernews. The supposedly pro-Sudanese group’s posts mainly started in Russian and English, adopting Arabic only later.

“They align with Russia and will not attack any Russian site even though the Quran has been burned inside Russia. They attack anyone that has a Quran burning in their country as long as it is the West or Israel. All others get a pass,” Bardin explained.

Meanwhile, Wåhlén pointed to the group's instant love affair with Killnet, another pro-Russian DDoS group, whose leader openly said he’ll be taking money for attacks that “defend the interests of the Russian Federation.”

“They align with Russia and will not attack any Russian site even though the Quran has been burned inside Russia.” Bardin said.

Is Anonymous Sudan tied to Killnet?

Killnet’s ties with Anonymous Sudan are hard to ignore. For one, both groups target organizations in the West – Killnet under the guise of defending Russia and Anonymous Sudan to fend off Western imperialism.

In mid-June this year, both groups and the now-defunct Russian ransomware gang REvil established “Darknet Parliament” to coordinate attacks. Conveniently, Sudan and Moscow are in the same time zone.

“They are obviously tied to this Russian group, Killnet. They’re not part of Killnet as such, but someone has probably paid Killnet to do the DDoS part of this, and I assume that they have found someone to help do the messaging,” Wåhlén said.

For example, Anonymous Sudan started using Arabic only after researchers noted that a gang identifying with an Islamic country converse mostly in Russian. The group deleted older posts to cover their tracks and started posting in school-taught Arabic, adopting the Sudanese dialect only later.

“[Their messaging] started in Russian, and they just changed it after Truesec wrote a report saying it was strange that they only communicated in Russian. Even if they now communicate in Arabic, it’s obvious that there are still Russians behind it. Anonymous Sudan hasn’t said that those who started the channel are gone or “that wasn’t us.” Another thing is that what they say very much fits a Russian narrative,” Wåhlén said.

How does Anonymous Sudan attack?

The group primarily employs DDoS attacks against “soft targets” without revealing their techniques, Bardin explained. All available data points to Anonymous Sudan relying on layer four attacks, known as SYN flood attacks in the industry...

To oversimplify, the attackers overwhelm the victim’s server with a vast number of incomplete requests. While the server is waiting to fulfill the requests, it cannot respond to legitimate queries, which makes a certain service or a website slow and, in worse cases – unresponsive.

It’s unlikely that Anonymous Sudan owns any of the numerous devices necessary to launch a large-scale DDoS attack. However, that’s not a problem as there are many service providers on the dark web who target whoever that client pays to attack. That’s where Anonymous Sudan differs from other hacktivist groups...

“Anonymous Sudan are conducting quite expensive DDoS attacks. They appear to have large funds available. Someone is paying them. I seriously doubt they operate on donations from Sudan. My guess is it’s someone who is supporting the Russian agenda. Maybe FSB or some oligarch. I don’t know, but that’s my guess,” Wåhlén said.

[mishey22]

They said they were getting DDoSed over on twitter:

It looks like the Archive is under a DDoS attack causing the servers to fall over. Our volunteer sysadmins are working on countermeasures. Please be patient with us, we'll be back!

https://twitter.com/AO3_Status

[(Anonymous)]

Thanks for the update! I'll be leaving the site be until I hear that the request flooding is over, then.

[(Anonymous)]

Shame it can't go down for good.

[(Anonymous)]

Are you okay? Show me where on the doll the AO3 touched you.

[(Anonymous)]

Of course you’d be here, anti-AO3 anon.

[(Anonymous)]

Why? You don't like other people having fun?

[(Anonymous)]

Since I don't have a Twitter account, I can't see the AO3_Status unless I have a link to a specific tweet. So, when AO3 went down earlier (11 hours ago) I went looking elsewhere. I found https://www.reddit.com/r/AO3/ and they've been pretty good about updating/commiserating. Though, AO3 apparently has a tumblr - https://ao3org.tumblr.com/, which I had no idea about before a half-hour ago.

[tabaqui]

https://twitter.com/AO3_Status/status/1678379783355342848

Still down for me.

[tabaqui]

Their Twitter page says it's a DDOS attack.
https://twitter.com/AO3_Status/status/1678379783355342848

Still down for me.

Latest from AO3

[(Anonymous)]

ao3org

24m ago

We've changed our approach slightly, so you might now see error messages other than "Retry later," such as 429 (too many requests), 400 (bad request), or 503 (service unavailable).

Please do continue to access the site if it's up for you, and feel free to download some works for offline reading in case of further downtime!

We'd also like to take a moment to reiterate that cybersecurity experts believe the group claiming responsibility for the ongoing DDoS attack is lying about their affiliation and reasons for attacking websites. We strongly encourage you to be skeptical of any statements from this group.

Date: 02:16 UTC July 11, 2023