Several large distributed denial of service (DDoS) attacks occurred this past weekend that affected a minimum of seven (7) email service providers internationally. Currently, the attacks targeted Fastmail, Guerilla Mail, Kolab Now, Posteo, RiseUp, Runbox, and TheXYZ, which TheRecord described as “small-time companies that provide privacy and security-centric email services” in their articles regarding the incident. TheRecord also revealed that after the attacks, an email was sent to the victim companies concerning a 0.06 Bitcoin (BTC) ransom demand, which is approximately $4,000 USD, and a threat of taking the victims’ networks offline if the ransom was not paid within three (3) days. It is suspected that the various attacks were conducted by the same threat actor” as a part of a DDoS extortion campaign”, as the emails were “signed by a group calling itself the Cursed Patriarch”. Posteo, Runbox, and TheXYZ have all released statements on their respective DDoS attack along with insight into the email from “Cursed Patriarch” as well as the peak amount of experienced data traffic, with TheXYZ currently having the highest amount at 256 gigabytes per second (Gbps). CTAPT analysts will continue to monitor for international DDoS attacks and examine the threat actors behind them.