DDoS attack against CANTV links targeting a PDVSA IP address (December 2016)
On December 2, 2016, a denial-of-service attack was recorded against CANTV’s international links, targeting the IP address 200.11.137.56 assigned to PDVSA. LANautilus/Telecom Italia reported the attack, and Digital Attack Map recorded a peak of 5,559 Mbps for about six minutes. The CrediCard outage occurred on the same day and was reported by authorities as an attack on the banking sector, but sources at CANTV indicated that the interbank network was separate from the internet and that the two events should not be treated as a single technical incident.
Impact details
It has been confirmed that DDoS/DoS traffic overwhelmed CANTV’s international links and targeted a PDVSA IP address, causing slowdowns and degradation of Internet service. The CrediCard service outage, which occurred on the same day, affected payment services; however, it has not been considered a confirmed technical impact of this DDoS attack, as CANTV sources have distinguished between the two events.
Classification & severity
- Category
- Availability
- Subtype
- Distributed denial of service
- Confidence
- High
Sources confirm a DDoS/DoS attack against CANTV’s international links targeting a PDVSA IP address. The CrediCard service outage that occurred on the same day is considered a contextual event and is not regarded as a confirmed technical consequence of the DDoS attack.
Severity assessment
High- Functional impact
- Degraded (critical)
- Information impact
- None
- Affected scope
- Multiple systems
- Critical service
- Degraded
- Public confidence
- Moderate
- Recoverability
- Regular
DDoS/DoS attacks against CANTV’s international links targeting a PDVSA IP address have been confirmed, affecting critical telecommunications and energy infrastructure. CrediCard is excluded from the direct technical impact, as sources indicate it is separate from the DDoS attack.
Timeline
DDoS attack against CANTV’s international links targeting PDVSA IP addresses; peak of 5,559 Mbps at 18:27 GMT (~6 min), reported by LANautilus/Telecom Italia and visible on Digital Attack Map.
CrediCard payment platform outage: point-of-sale terminals and ATMs inoperable for ~20 banks; long lines and cash shortages. CrediCard attributed the outage to technical glitches.
Maduro denounces a cyberattack and an “economic coup,” attributing it to the U.S. (Department of the Treasury) and the “national right wing”/Colombian mafias, and orders SEBIN to intervene in CrediCard.
CANTV President Manuel Fernández provides details about the attack and clarifies that the attack on CANTV and the CrediCard outage were separate events (the interbank network is isolated from the internet).
SEBIN arrests CrediCard employees and executives in connection with the alleged attack on the payment system.