Key insights
- RipperSec is a pro-Palestinian, pro-Muslim hacktivist group operating from Malaysia
- RipperSec has been operating on Telegram since June 2023 and accumulated over 2,000 members in a little over a year
- MegaMedusa is a publicly available Web DDoS attack tool created and maintained by a member of the RipperSec group
- MegaMedusa can be installed in just five simple commands allowing anyone to launch highly scalable Web DDoS attacks against targets of their choice
- The MegaMedusa attack tool uses 10 randomization techniques to diversify its attack requests and make the detection and mitigation of its attacks harder
- MegaMedusa makes some rudimentary attempts to evade CAPTCHA triggers through randomization and proxy use, but it does not include advanced CAPTCHA-solving capabilities
- RipperSec's threat and scale do not come from a large and sophisticated attack infrastructure but from its community. Community has always been activists' and hacktivists' most powerful weapon.
What is RipperSec?
Figure 1: RipperSec Telegram profile (Source: TGStat)
RipperSec is a pro-Palestinian and pro-Muslim Malaysian hacktivist group. Their Telegram channel @RipperSec was created in June 2023 and accumulated over 2,000 subscribers by August 8, 2024.
RipperSec often works in alliance with other like-minded hacktivist groups and hackers in and outside of the region, including Tengkorak Cyber Crew, Eagle Cyber Crew, Stucx Team, 4Exploitation, Khalifah Cyber Crew, Helang Merah Group, Rex AnonSaven7, Team Cyber Ababil, Malaysia Hacktivist, Zenimous Crew, Laskar Pembebasan Palestina aka the Palestine Liberation Army, Garruda From Cyber (GFC), Holy League, Moroccan Cyber Black Army and several others. Most hacktivists from Malaysia do not agree with the actions taken by Israel and consider all countries that support Israel as enemies.
RipperSec’s attack activity includes data breaches, defacements and DDoS attacks—anything that creates chaos, attracts attention and causes disruption that’s typical for a hacktivist group.
RipperSec DDoS Attack Claims
Between January 1 and August 8, 2024, RipperSec claimed 196 DDoS attacks. Almost a third of the attacks targeted Israel. India, the United States, the United Kingdom and Thailand were other countries with significant attack activity claimed by RipperSec in 2024.
Figure 2: Number of attacks claimed per month by RipperSec (Source: Radware)
Figure 3: RipperSec’s top targeted countries (Source: Radware)
RipperSec targeted mostly government and educational websites, followed by business, society and financial services.
Figure 4: RipperSec’s top targeted website categories (Source: Radware)
RipperSec’s activity did not stop after August 2024. Later reporting continued to describe the group as active and resilient, despite the reported death of one of its leaders in July 2024, with attacks continuing through a decentralized structure and alliances with other hacktivist groups. ENISA assessed that, during 2024, RipperSec intensified operations using its MegaMedusa DDoS tool and focused on public administration targets in France, Austria, Italy and Belgium.
In 2025, RipperSec remained active in geopolitically motivated DDoS campaigns. During the India-Pakistan tensions around Operation Sindoor, Radware reported that RipperSec was the most active threat group targeting India, responsible for more than 30% of all DDoS claims in the tracked 2025 India campaign.
The same dataset showed that more than half of the claimed DDoS attacks against India targeted government institutions, followed by education, finance, manufacturing and telecom. Silobreaker similarly linked RipperSec to #OpIndia activity, noting that DDoS claims surged between April 22 and May 10, 2025, with RipperSec responsible for more than 30% of claims against India during that period.
RipperSec also broadened its geographic targeting. In February 2025, the group claimed a DDoS attack against the RightIsland website. In March 2025, it claimed a DDoS attack against the official website of South Korea’s Gyeonggi Province Governor. By 2026, South Korea had become a more explicit focus: S2W reported that RipperSec selected South Korea as a target in February, 2026, citing alleged South Korean arms exports to Israel.
What is MegaMedusa?
MegaMedusa is a publicly available Web DDoS attack tool created and maintained by a member of the RipperSec group. The tool’s source code is published on GitHub and while its JavaScript code is obfuscated, it is easy enough to deobfuscate and recover readable code. While written in JavaScript, MegaMedusa is a command-line tool to be executed using the Node.js cross-platform JavaScript runtime environment. Node.js provides asynchronous and non-blocking I/O, allowing it to handle multiple requests concurrently. This makes it highly efficient for I/O-bound tasks such as managing large amounts of network connections. Node.js applications also can run on multiple platforms (Windows, macOS, Linux) without the need for platform-specific code.
Figure 5: MegaMedusa Layer 7 DDoS attack tool (Source: GitHub)
Installation and Operation
The author of MegaMedusa provides an installation script and steps to install and run the tool on the code repository’s GitHub landing page. Only five simple commands are needed to download and install the Node.js runtime environment and all required dependencies. Anyone who runs a Linux-based system at home or rents a Linux-based virtual private system in a public or bulletproof cloud can gear up to launch highly scalable Web DDoS attacks against targets of their choice in only a few minutes.
Figure 6: MegaMedusa installation instructions (Source: GitHub)
The publicly available version of MegaMedusa allows attacks directed at any online web application or API. On the command line, users can specify the number of simultaneous threats that should be executing web requests, the attack rate expressed in requests per second (RPS) and the duration of the attack in seconds. Specifying a text file with open proxies allows the attack traffic to be distributed across proxies. For each new request, the proxy is randomly chosen from the list of proxies provided in the command line.
Figure 7: MegaMedusa command line usage and description of command line arguments (Source: GitHub)
Randomization of Web Requests
The MegaMedusa attack tool leverages several levels of randomization to diversify its attack requests and make detection and mitigation of its attacks harder. Here are the key randomization techniques used by MegaMedusa:
- Randomized Headers:
- User-Agent Strings: The script randomizes the User-Agent header, which represents the client’s browser and operating system. Different user agents make the requests appear to come from various types of devices and browsers.
- Accept-Language, Accept-Encoding, Cache-Control, etc.: These headers are randomized to simulate requests from different regions, clients and configurations. For example, the Accept-Language header is randomized to suggest different languages.
- Referrer Header: The Referrer header is randomized to make it appear as if the request is coming from various legitimate pages like Google Search.
- Connection Header: The script randomly alternates between keep-alive and close in the connection header.
- Randomized Request Paths:
- Query Parameters: The script appends random query strings and parameters to the URL path to create unique URLs. For example, it might add ‘?s=’, ‘?page=’, or other parameters with random values to the URL.
- Path Segments: It also includes random path segments such as ‘/’ and ‘/.lsrecap/recaptcha?’ to diversify the request paths or target specific functionalities of the website like reCAPTCHA to increase the impact on the backend infrastructure of the website.
- Randomized Request Methods: The HTTP request method (GET, POST, HEAD, etc.) is randomized. Each request might use a different method, making it more difficult to identify patterns.
- Randomized Cookies: Randomly generated cookies make each request appear as though it comes from a different session or user. Some cookies such as ‘cf_clearance’ are randomly generated within specific patterns to attempt to bypass security features.
- Random IP Addresses (IP Spoofing): The X-Forwarded-For, Client-IP, Real-IP, X-Forwarded-Host, and other headers are filled with random IP addresses used to spoof the origin of the request.
- Randomized TLS/SSL Configurations: The script randomizes the use of different TLS/SSL ciphers and protocols when establishing a connection. This makes the TLS handshake appear unique.
- Randomized HTTP/2 Settings: HTTP/2 settings such as headerTableSize, maxConcurrentStreams, initialWindowSize, etc., are randomized to vary the HTTP/2 session characteristics.
- Proxy Randomization: The tool selects a random proxy from a list of proxies for each request, which diversifies the apparent source IP addresses and geolocations of the requests.
- Random Timing Intervals: The attack tool uses setInterval() to send requests at intervals, which can be configured and randomized to vary, making the timing of requests less predictable.
- Randomized Header Values: Random values are inserted into certain headers, such as Sec-WebSocket-Key, Sec-WebSocket-Version, etc., making each request appear unique even at the WebSocket level.
These techniques combined make the requests appear unique and diversified, which helps avoid detection or blocking by standard web application firewalls (WAFs) and other common security measures designed to mitigate suspicious or malicious traffic patterns.
Open Proxy Support
While MegaMedusa provides support for open proxies and includes a tool to scrape fresh lists of open proxies from publicly available open proxy lists, commercial proxies and private proxies that require authentication are not supported. Adding support for authentication, however, is not a big task and the code shows that the author is not an inexperienced Node.js developer. There is also evidence that the core members of RipperSec use several more evolved and improved versions of MegaMedusa. It is likely that certain attacks leverage commercial proxy lists to diversify traffic across hundreds of thousands of IP addresses, compared to the several thousand open proxies that can be freely scraped.
The Node.js scrapers provided in the repository are very basic, but they do provide a list of over 30 different resources on the internet that can be used to create custom proxy files. Moreover, searching the internet for open proxy lists is easy enough. Most open proxy websites provide a download function to save a filtered list of proxies in text format that can be directly used with the MegaMedusa tool.
Security Challenge Bypasses
The author of MegaMedusa claims challenge bypass support for several security vendors including Cloudflare’s Under Attack Mode and NoSec, DDoS Guard, vShield and ShieldSquare Captcha (Radware).
Figure 8: MegaMedusa challenge bypass features (Source: GitHub)
While MegaMedusa makes some rudimentary attempts to evade CAPTCHA triggers through randomization and proxy use, it does not include advanced CAPTCHA-solving capabilities. It mainly focuses on making the requests appear diverse and less detectable rather than directly bypassing CAPTCHA challenges. True CAPTCHA bypass typically requires more sophisticated approaches, such as solving the CAPTCHA or using pre-solved tokens, neither of which is present in this script.
The implementation of security challenge bypasses in MegaMedusa will not cut through current modern security challenges. The internet is saturated with both accurate and misleading content, along with a wide range of examples—some functional, others ineffective—claiming to bypass bot detection using HTTP request header manipulation. It is not impossible to bypass security challenges and fingerprinting detections but relying on static bypass and using randomly generated and pre-provisioned HTTP request headers as implemented in MegaMedusa and shown in the code below has a very limited success rate.
The most efficient way to circumvent protections and challenges is to find the server's origin IP address. This, however, is only possible in scenarios where the origin server is exposed on the internet and does not adequately filter traffic other than from known and authorized secure gateways.
Figure 9: HTTP header parameters, including captcha bypasses (Source: MegaMedusa.js)
MegaMedusa does not include any functionality to automatically solve CAPTCHAs such as image recognition and reCAPTCHA v2/v3 tokens. Sophisticated CAPTCHA bypassing typically involves using machine learning models, CAPTCHA-solving services, or leveraging browser automation tools like Puppeteer or Selenium to interact with CAPTCHAs in real-time, which MegaMedusa does not do.
The code does include some basic CAPTCHA handling elements that interact with CAPTCHA challenges, such as using random __cf_chl_tk tokens, which are related to Cloudflare's CAPTCHA challenges. However, these tokens are randomly generated and not tied to an actual CAPTCHA-solving process. Without solving the CAPTCHA correctly, these tokens are unlikely to be valid.
RipperSec and MegaMedusa
While a member of the RipperSec group made a version of MegaMedusa publicly available for volunteers and subscribers of the RipperSec Telegram channel, there is evidence that shows the use of improved and more capable custom versions of the tool used by RipperSec group members. Below is a screenshot taken from an advertisement video shared by RipperSec. While not the best quality, it is possible to see several alleged Node.js attack programs in the directory listing. It is reasonable to assume that core RipperSec members have access to more capable tools than the one that is shared publicly and used by volunteers and allies of the group.
Figure 10: Screenshot demonstrating an attack and more advanced attack tools (Source: RipperSec)
Generating Web DDoS Attacks (for educational purposes)
The name Web DDoS attack refers to a high rate of web requests directed at an online web application or API, leveraging different methods of request randomization and proxies. Proxies conceal the origins of web requests and make detection and mitigation more difficult by making it look like the requests are coming from many different locations. Proxying requests can also circumvent measures like geo-blocking by leveraging proxies inside the country of the victim.
Proxying Requests
Tunneling web requests is performed by creating a TCP connection with a proxy and requesting the proxy to ‘connect’ to the target (see image below). The proxy handles the SSL and HTTP connection with the target and responds with a status 200 when the connection is established successfully. The attacker node is now able to send requests to and receive responses from the target through its TCP tunnel connection with the proxy. From the perspective of the target, the communication is established from the proxy and not from the attack-generating node, concealing the location of the attacker’s infrastructure.
Figure 11: A HTTPS request tunneled through a Proxy (Source: Radware)
Node.js provides several libraries that implement web requests through proxies such as the NPM (Node Package Manager) modules http-proxy-agent and https-proxy-agent. Proxying web requests using the https-proxy-agent module is as easy as creating an agent object using the statement “agent = new HttpsProxyAgent(‘http://:’)”, followed by a regular HTTPS request using the https standard library module and passing the agent object as an argument (see image below).
Figure 12: https-proxy-agent module example (Source: GitHub)
MegaMedusa, however, does not leverage the https-proxy-agent module. It implements proxy support natively by first creating a proxy socket, followed by the connect command to the proxy and then passing the established socket to the https module for performing the GET/POST/HEAD/... request. Native implementations reduce the dependencies on third-party modules and leave the author in control of the connection options and the lifetime of the proxy connection.
Optimizing Attack Request Rates
To support a world that has become more reliant on web and mobile applications providing real-time access to data combined with great user experience, the protocol specifications for HTTP were improved over time to include mechanisms that reduce the latency and increase the throughput, while decreasing resource requirements on both client and server. While these improvements were meant to improve the efficiency of applications and server infrastructure, they also serve malicious actors by making their attacks more efficient.
HTTP/1.1 pipelining is used primarily to improve the efficiency of sequential requests but suffers from limitations like head-of-line blocking. While not widely adopted due to its limitations, it is much liked by attackers because it allows them to increase the number of RPS from the same infrastructure without too much impact on resources and it is very easy to implement.
HTTP/2 introduced multiplexing, which allows multiple HTTP requests and responses to be performed concurrently over a single TCP connection. This implementation overcomes the limitations of HTTP/1.1 pipelining and provides a more efficient use of network resources, reducing latency and improving page load times for users. As with pipelining, multiplexing also allows attackers to efficiently increase their RPS numbers. To make it more evident, in October 2023, the HTTPS/2 Rapid Reset vulnerability was disclosed. This resulted in a large number of DDoS-for-hire services introducing this technique as a new attack vector in their arsenal of attack tools. Another notable vulnerability is the HTTP/2 Continuation vulnerability, which was disclosed in April 2024.
Open and Commercial Proxies
Open proxies typically consist of compromised residential routers and servers. IoT botnets compromise vulnerable modems, routers and weakly secured cloud servers not only to generate attacks, but the same enslaved devices can also be leveraged as HTTP or SOCKS proxies by incorporating proxy functionality in the bot, installing a proxy server on the compromised device or just by reconfiguring the device and living off the land (LOTL) from services offered by the router or gateway. By leveraging devices located in residential IP ranges, attacks are less prone to be filtered as they share the same location as legitimate users.
Commercial proxy vendors deploy servers behind residential IP addresses and lease unused ranges from internet service providers. They consolidate the proxy service on a single or several Linux servers running, for example, a Squid proxy.
Figure 13: Services offered by commercial proxy services (Source: Internet)
Most commercial proxy services offer features like daily rotating IP addresses, which change 30% or more of the IP addresses in the pool of proxies every day. Attackers can leverage this to avoid blocking from IP feeds that provide longer-term analysis for the collection of malicious IP addresses.
Many commercial proxy providers also offer a free list. These lists can be leveraged without additional cost but with limitations in time or in the service rendered. There are also several unmanaged lists scattered around the internet, hosted publicly on GitHub and in other places, containing free and open proxies. Proxies from those lists are typically hit and miss, but by leveraging a proxy checker tool it is still possible to generate working lists of free and open proxies to perform attacks. The IT Army of Ukraine, for example, as part of its IT Army Kit, provides a curated list of proxies scraped from several locations on the internet and includes it with their improved version of MHDDOS. More information about the IT Army Kit and DDoS tools offered by the IT Army of Ukraine to volunteers supporting its cause can be found here.
Figure 14: Free proxy list offered by commercial provider, categorized by protocol, country and latency and providing an API URL for dynamically loading proxies in software (Source: internet)
Advanced DDoS Attacker Infrastructure
Sophisticated DDoS attackers and DDoS-for-hire service providers leverage a whole arsenal of attack tools ranging from several variants of network DDoS amplification and reflection to Web DDoS with different randomizations of payloads and protection evasions. Depending on the attack, attackers conceal their infrastructure and increase their reach by leveraging source IP spoofing, proxy and SOCKS services and, in some cases, routing through the Tor overlay network.
Threat actors, like businesses, find agility and scale in the cloud. By transitioning from internet of things (IoT) devices to a cloud-centric model, they enhance scalability, reliability and ease of management compared to trying to control and maintain a huge number of infected IoT devices. The scanning and infecting of IoT devices is also more prone to getting noticed by honeypots, resulting in exposure and potentially the takedown of the command and control (C2) infrastructure.
Bulletproof hosters provide more lenient content policies and are often used for hosting content or services that regular hosting providers would not permit due to their policies. While they provide more freedom, they are often associated with nefarious activities and are scrutinized for hosting malicious content. They also provide malicious actors with a more stable environment as the providers are not responding to abuse and take down messages from the security community.
Figure 15: Advanced DDoS attackers’ cloud infrastructure (Source: Radware)
While the cloud provides many benefits for attackers’ infrastructure, there are still plenty of botnets in use and leveraged for DDoS attacks. Botnets are good at creating highly distributed attacks. A botnet is the better platform to launch, for example, highly impactful DNS Water Torture or Pseudorandom Subdomain (PRSD) attacks as it leverages the trust relation between DNS forwarders and the residential IP ranges of the internet service providers (ISP). Some DDoS-for-hire services start with botnets as a cheaper alternative for their attack infrastructure. As they grow and need to provide more scalable and stable services to their customers, we see them transition to a hybrid infrastructure consisting of both botnets and cloud attack nodes.
The same IoT botnets used for DDoS attacks can also be leveraged for proxy and SOCKS services. Once IoT devices are compromised, it is rather easy for a bot herder to change or diversify his services by updating his bot’s functionality and increasing and diversifying their revenue streams.
How to Defend Against RipperSec-Style Threats
DDoS Protection
Organizations that may be targeted by RipperSec-style campaigns should use always-on DDoS protection that covers both network-layer and application-layer attacks. MegaMedusa-style tooling focuses on web requests, so volumetric capacity alone is not enough. Protection must inspect HTTP and HTTPS traffic, identify abnormal request behavior and separate attack traffic from real users.
Effective mitigation should include behavioral baselining, TLS fingerprinting, HTTP/2 anomaly detection, rate controls and automated challenge mechanisms. Since these attacks often use proxies, blocking by country or IP reputation alone will have limited value. Defenses should correlate signals across headers, request paths, session behavior, proxy use, user-agent consistency and request timing.
Organizations should also test their protection before a crisis. This includes validating that DNS, CDN, WAF, load balancers, APIs and origin servers are covered by the mitigation path. A common weakness is an exposed origin IP address that allows attackers to bypass the CDN or cloud security provider.
Incident Response Readiness
DDoS response should be planned before an attack starts. Teams should define who can activate mitigation, who communicates with providers and who makes decisions about temporary controls such as geo-blocking, rate limits or emergency access rules.
A useful runbook should include escalation contacts, traffic thresholds, logging requirements and steps for preserving evidence. It should also include templates for internal updates, customer-facing status messages and regulator or partner notifications where required.
During an attack, responders should track the attack start time, target assets, request patterns, source distribution, HTTP methods, user agents, proxy indicators and any changes in attacker claims. This helps defenders tune mitigations and supports post-incident analysis.
Web and Infrastructure Hardening
Web applications and APIs should be hardened to reduce the impact of high-volume request floods. Expensive endpoints such as login, search, checkout, password reset, file download and CAPTCHA verification should have specific rate limits and abuse controls.
Caching should be used wherever possible to reduce load on origin systems. Static content should be served through a CDN, and dynamic pages should be optimized so that repeated requests do not trigger unnecessary database queries or backend processing.
Origin servers should only accept traffic from trusted CDN, WAF or DDoS mitigation networks. Administrative interfaces, staging systems and exposed APIs should not be reachable from the public internet unless required. Where public access is needed, access controls, authentication and strict rate limits should be applied.
Threat Intelligence Monitoring
RipperSec and similar hacktivist groups often announce targets, campaigns and attack claims on Telegram and other public channels. Monitoring these sources can provide early warning before attacks begin or help confirm attribution during an incident.
Threat intelligence should track group aliases, campaign hashtags, target lists, tool releases, claimed victims and alliances with other hacktivist crews. This information can help security teams prioritize exposed assets and prepare temporary protections during periods of geopolitical tension.
Monitoring should not rely only on attacker claims. Claims should be compared with telemetry from DDoS systems, WAF logs, CDN analytics, uptime monitoring and application metrics. This helps separate real attacks from exaggerated or false claims.
Contact Radware Sales
To learn how Radware can help secure your applications and APIs against evolving cyber threats like RipperSec and similar threats, contact us today.