RDoS attacks by fake Fancy Bear hit banks in multiple locations

In late October 2019 a mass email extortion (RDoS) campaign targeted banks and financial organizations across multiple regions, impersonating Fancy Bear to demand 3 BTC and threatening DDoS attacks; some recipients saw small demonstration UDP/ICMP floods (including use of UDP port 3283). Group-IB concludes the activity was financially motivated extortion by impostors rather than the real APT28, and highlights indicators such as the sender [email protected] and the novel use of ARD-related UDP port 3283 in DDoS traffic.