ACCN Hacker Group Strikes Again — New TapTap Games Face DDoS Extortion From Taiwan-Based Criminal Ring That Small Studios Can't Escape

Here we go again. The ACCN hacker group has launched yet another DDoS attack on a newly released game on TapTap — not against the big studios with enterprise-grade protection, but deliberately targeting small indie teams. It's happened so many times that even NGA users are yawning: "At this point it barely counts as drama anymore."

【How It Went Down: A Vicious Cycle for Indie Devs】According to the original post, the latest victim is a freshly launched TapTap game with decent early traction. In fact, any non-major-studio game that shows signs of a hot launch will inevitably get targeted by ACCN. Previous victims include well-known titles like CrossFrontline (交错战线), among others.

【The Extortion Math: ¥10K Ransom vs. ¥100K Protection】The original post lays out a soul-crushing cost comparison: ACCN demands roughly ¥10,000 (~$1,400 USD) in ransom, while professional DDoS protection from major cloud providers like Tencent or Alibaba starts at ¥100,000 (~$14,000 USD). For cash-strapped indie teams, this isn't a choice between "pay or don't pay" — it's choosing how to die. During an attack, players hemorrhage away, store ratings tank, and all that launch marketing budget goes down the drain — hidden costs that dwarf the ransom itself. So many small studios just grit their teeth, pay the "protection money," and buy proper security afterward.

One commenter revealed that a game studio had to essentially pay "protection fees" to Tencent (i.e., buying their anti-DDoS service) just to end ACCN's harassment. A reply from user #2 claimed to be in the game's beta Discord/group and saw screenshots of the actual ransom amount, with Tencent's protection quoted at ¥100,000. The commenter lamented: "Better to give money to Tencent than to these scumbag hackers" — but the harsh reality is that most small studios can't even afford that ¥100K and simply "die in silence."

【Why Can't They Be Caught? Taiwan as a Lawless Haven】The most gut-wrenching comment came from user #2: "The team is based in Taiwan, not the mainland. Unless China pulls something like the Myanmar operation, there's no real way to deal with them." User #4 added: "Taiwan authorities won't do anything about it either." User #14 posted a sarcastic meme with the caption "We're all compatriots, why do this?" — dripping with helpless irony. User #16 was blunt: "ACCN has been active for years and nobody can touch them. The only hope is a physical takedown."

【Tech-Savvy Users Share DIY Countermeasures】Not all hope is lost, at least technically. User #9, clearly someone with backend engineering expertise, proposed a budget-friendly workaround for small studios: spin up multiple load balancers (LBs) on Tencent Cloud to proxy your game servers, and build client-side failover logic — when an LB goes down, fetch a new LB address from your CDN. When DDoS hits, disable the targeted LB and update the CDN with the new IP (set cache TTL to 0). In theory, "there's no script kiddie alive that can take down a CDN." Toggle a few times and the attackers burn out. However, other users raised concerns: can't you just block the attacking IPs? User #13 explained: "Nope — with widespread NAT usage, blocking one IP might cut off an entire region of legitimate users."

【The Real Problem: Absurd Cost Asymmetry】User #11 cut straight to the core: "The real issue is the insane price gap between DDoS attack and defense." That's the fundamental paradox — launching an attack is dirt cheap, defending against it is prohibitively expensive, and legal prosecution is essentially impossible. It's a perfect breeding ground for cybercrime. User #7 put it poetically: "On one side, hackers extort you city by city, like ancient warlords demanding tribute; on the other, Tencent charges ¥110K for protection. Small teams are truly walking a tightrope."

As of now, ACCN remains as active as ever with no effective countermeasure in sight. For small and mid-size game studios, the question has shifted from "will we get attacked?" to "when will we get attacked?" Until this systemic issue is resolved, every promising new game on TapTap is a potential next victim.