{"id":5360,"date":"2026-10-17T01:08:20","date_gmt":"2026-10-17T01:08:20","guid":{"rendered":"https:\/\/cyberasia.io\/?p=5360"},"modified":"2026-10-17T01:08:23","modified_gmt":"2026-10-17T01:08:23","slug":"rippersec-hits-israeli-retailer-bug","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/ddos\/rippersec-hits-israeli-retailer-bug\/","title":{"rendered":"RipperSec DDoS Attack Hits Israeli Retailer BUG: 522 Errors"},"content":{"rendered":"\n

A RipperSec DDoS attack pushed the public website of Israeli electronics retailer BUG<\/mark><\/strong> into Cloudflare error 522, “Connection timed out<\/mark><\/strong>,” according to screenshots from an operation the group scheduled for 20:00 on September 15, 2026. Check-host reports posted under the group’s #OpZionistV2 banner show timeouts and HTTP 503 responses<\/mark><\/strong> from probe nodes including Tirana, Sydney and Sofia.<\/p>\n\n\n\n

RipperSec describes BUG as Israel’s largest retail chain for computers and consumer electronics. That description comes from the group’s own post, and no statement from BUG or Israeli authorities had been located at the time of writing.<\/p>\n\n\n\n

This report sticks to what the five screenshots show and marks what remains unconfirmed.<\/p>\n\n\n\n

How the RipperSec DDoS Attack Was Announced<\/h2>\n\n\n\n
\"Figure
Figure 1 : RipperSec DDoS attack order post naming Israeli retailer BUG as the OpZionistV2 target with a 20:00 start<\/figcaption><\/figure>\n\n\n\n

The first post is a forwarded message from a channel handle, RipperSecDirect. It carries an #OpZionistV2<\/mark><\/strong> banner, a “NEW TARGET RELEASED” header and a short target card. The target name is BUG. The order time reads 20:00, the time zone field reads 08:00GMT, and the date reads 15\/09\/2026. The card then lists https:\/\/www.bug.co.il\/ as the address and adds a reminder to activate a VPN.<\/p>\n\n\n\n

The message line says “Stop Ki**ings People, We Are Watching Your Action,” and the post ends by thanking allies.<\/p>\n\n\n\n

A fixed start time and a VPN reminder fit a crowd-driven format. Public profiles say each RipperSec DDoS attack leans on follower participation, not on a large private botnet.<\/p>\n\n\n\n

Error 522 and HTTP 503: What the Evidence Shows<\/h2>\n\n\n\n
\"Figure
Figure 2 : RipperSec DDoS attack screenshots showing Cloudflare error 522 on bug.co.il and HTTP 503 results from Tirana, Sydney and Sofia<\/figcaption><\/figure>\n\n\n\n

The left post pairs a Cloudflare error page for www.bug.co.il, error code 522, with a capture of the shop’s Hebrew storefront and an “All United for Free Palestine” graphic. Its caption adds a check-host report link.<\/p>\n\n\n\n

The right post is a world map chart with a terminal capture on top, linked to a check-host.cc report. Three rows are visible. Tirana, Sydney and Sofia each show HTTP 503 with 0 of 60 requests answered successfully. Average response times are 9,298 ms, 6,406 ms and 5,192 ms, with peaks above 14,000 ms.<\/p>\n\n\n\n

Error 522 is specific to Cloudflare. It means the edge network accepted the visitor’s request but the origin server did not complete a connection in time, which points at pressure on the origin and not a loss of the CDN itself. Cloudflare documents the code in its error 522 guide<\/mark><\/a><\/strong>. A 503 means the service could not handle the request. Together they fit an overload during the RipperSec DDoS attack, though neither names the cause on its own.<\/p>\n\n\n\n

Attack Tool Output and the Proof Trail<\/h2>\n\n\n\n
\"Figure
Figure 3 : RipperSec logo, a skull framed by crescent moons with the group name in Latin and Arabic script<\/figcaption><\/figure>\n\n\n\n

The next batch of posts in the RipperSec DDoS attack thread, time-stamped 19:37 to 20:27, moves from site errors to the operators’ own consoles. One terminal capture lists requests to WordPress paths on bug.co.il<\/mark><\/strong>, including xmlrpc.php, wp-login.php and wp-json routes<\/mark><\/strong>, with several [429] responses<\/mark><\/strong>. A 429 means too many requests, so at least part of the site was rate limiting the traffic.<\/p>\n\n\n\n

Another capture shows an “attack launched” banner naming a TLS method and a 120-second run, followed by log lines marked HTTP FAIL (TIMEOUT) at 5000 ms. A third console lists the target URL and request counters. Two check-host tables list resolved addresses in ranges commonly used by Cloudflare, which fits the 522 page.<\/p>\n\n\n\n

Seven report links appear across the screenshots, six of them time-stamped between 19:36 and 20:28. CyberAsia.io does not reproduce tool names or settings.<\/p>\n\n\n\n

Site Messages and the Closing Post<\/h2>\n\n\n\n
\"Figure
Figure 4 : Attack tool consoles and check-host proof links posted during the RipperSec DDoS attack on BUG<\/figcaption><\/figure>\n\n\n\n

The final screenshots add two views from the target’s side. A browser capture shows “This site can’t be reached” for www.bug.co.il beside another check-host table and a Go-based request tool log showing tens of thousands of requests sent.<\/p>\n\n\n\n

The last post, at 20:41, shows bug.co.il in a mobile browser with a plain notice that the website is experiencing a problem and will be back soon. The caption praises “all RipperSec soldiers.”<\/p>\n\n\n\n

A notice like that can come from the retailer itself, for example after switching on a protection mode. It shows the site was unavailable to that visitor at that moment, not how long the disruption lasted. No recovery time for the RipperSec DDoS attack appears anywhere in the material.<\/p>\n\n\n\n

About RipperSec<\/h2>\n\n\n\n
\"Figure
Figure 5 : Browser error pages for bug.co.il and the group’s wrap-up post after the RipperSec DDoS attack<\/figcaption><\/figure>\n\n\n\n

The logo is a black circular badge with a white skull framed by crescent moons, and the name RipperSec in Latin and Arabic script. Cyble’s threat actor profile<\/mark><\/a><\/strong> describes the group as pro-Palestinian, active since June 2023 and responsible for nearly 200 DDoS attacks, many aimed at Israeli government and private sector sites. Cyble also links it to a public attack tool called MegaMedusa<\/mark><\/strong>.<\/p>\n\n\n\n

The consoles in this campaign carry other banners, so the screenshots do not show which tool generated the traffic in this RipperSec DDoS attack.<\/p>\n\n\n\n

What This Means for Retail Sites<\/h2>\n\n\n\n

BUG is a storefront target, not a government one. A RipperSec DDoS attack on a retail domain hits browsing, ordering and support pages first, while physical branches keep trading. The posts show website symptoms only. They do not mention payment systems, customer records or branch operations, and nothing in them points to stolen data.<\/p>\n\n\n\n

Defensive Steps for E-Commerce Teams<\/h2>\n\n\n\n

Retail teams can blunt a RipperSec DDoS attack like this one with a short list of controls:<\/p>\n\n\n\n