Further attacks exacerbate the global cybersecurity crisis, according to the latest NETSCOUT Threat Intelligence Report. Around 2021 million DDoS attacks were recorded from January to June 5,4. That is an increase of 11% compared to the same period last year. This development could break the record from 2020, with far-reaching effects on critical Internet gateways.
NETSCOUT SYSTEMS, Inc. has published results in its biannual Threat Intelligence Report that underscore the dramatic impact of ongoing cyberattacks on businesses, public institutions and governments around the world. Around 2021 million DDoS attacks (Distributed Denial of Services) took place in the first half of 5,4. That's an 11% increase over the same period in 2020. According to estimates by NETSCOUT's Active Level Threat Analysis System (ATLAS ™) Security Engineering and Response Team (ASERT), 2021 could be another record breaking year, in which the 11 Millions of global DDoS attacks could be exceeded. ASERT also assumes that this development will continue and lead to an increasing cybersecurity crisis, which will have consequences for private and public organizations.
More than 11 million DDoS attacks expected
In the course of the incidents with Colonial Pipeline, JBS, Harris Federation, the Australian broadcaster Channel Nine, CNA Financial and several other high-profile examples, the effects of DDoS attacks and other cyberattacks have become noticeable worldwide. As a result, leading states have introduced new countermeasures and strategies. Investigative agencies are also working together in unprecedented ways to tackle the crisis.
In the first half of 2021, cyber criminals equipped themselves with seven new reflection / amplification DDoS attack vectors, which created an even greater risk for companies. This enormous increase in attack vectors also led to an increase in so-called multi-vector attacks. The record now stands at 31 vectors that were used simultaneously in a single attack on a company.
Results from the NETSCOUT Threat Intelligence Report:
- New adaptive DDoS attack techniques bypass traditional defense mechanisms. By adapting their strategies, cyber criminals have developed their skills to bypass cloud-based and on-premise static DDoS defense systems. They are targeting commercial banks and credit card providers.
- The connectivity supply chain is increasingly exposed to attacks. Attackers who want to cause particularly great damage concentrate their activities on important Internet components such as DNS servers, VPN concentrators (Virtual Private Network), services and Internet exchanges and interrupt important gateways in the process.
- Ransomware gangs also use DDoS to blackmail their victims three times. Ransomware has grown into big business. The criminals are now adding DDoS to their extortion methods in order to increase the pressure on the victims and to put additional strain on the security teams. Triple extortion combines file encryption, data theft and DDoS attacks. So the cyber criminals are more likely to receive a ransom payment.
- The fastest DDoS attack was 16,17% faster compared to the previous year. A wired broadband internet user from Brazil carried out the attack, which was likely related to online gaming. With DNS reflection / amplification, TCP ACK flood, TCP RST flood and TCP SYN / ACK reflection / amplification vectors, the sophisticated attack recorded 675 Mpps.
- The largest DDoS attack had a scope of 1,5 Tbps and was 169% larger than in the previous year. According to ASERT data, this is an attack on a German Internet provider in which a DNS reflection / amplification vector was used. The enormous scope represents a dramatic increase compared to all attacks recorded in the first half of 2020.
- Botnets contribute to the high number of DDoS attacks - numerous botnets have also been misused for more than 2,8 million DDoS attacks. This is shown worldwide by clusters of botnets and zones with a high density of the sources of attacks. In addition, the well-known IoT botnets Gafgyt and Mirai continue to pose a serious threat as they are responsible for more than half of all DDoS attacks.
“Cyber criminals are making headlines by launching an unprecedented number of DDoS attacks. They are taking advantage of the increase in remote work caused by the pandemic and disrupting key components of the connectivity supply chain,” said Richard Hummel, Head of Threat Intelligence at NETSCOUT. “Ransomware gangs have expanded their repertoire to include DDoS tactics and are now conducting triple extortions. At the same time, the Fancy Lazarus DDoS ransomware campaign has picked up speed, threatening companies across multiple industries. The focus is on ISPs and in particular on their crucial DNS servers.”
Report shows the latest developments
NETSCOUT's Threat Intelligence Report contains the latest developments and activities on the DDoS threat situation. It comprises the data backed up by NETSCOUT's Active Level Threat Analysis System (ATLAS ™), combined with the findings of NETSCOUT's ATLAS Security Engineering & Response Team (ASERT).
The assumptions and analyzes presented in the Threat Intelligence Report and in the Omnis Threat Horizon flow into the ATLAS Intelligence Feed, which is used in the entire Omnis security product portfolio from NETSCOUT. In this way, threats to companies and service providers can be identified and blocked worldwide.
More at Netscout.com
About NETSCOUT
NETSCOUT SYSTEMS, INC. (NASDAQ: NTCT) helps secure digital business services against disruptions in availability, performance, and security. Our market and technology leadership results from the combination of our patented smart data technology with intelligent analysis options. We offer end-to-end real-time transparency and insights that customers need to accelerate and secure their digital transformation. Our Omnis® Cybersecurity Advanced Threat Detection and Response Platform offers comprehensive network transparency, threat detection, highly contextual investigations and automated damage control at the network edge. NETSCOUT nGenius ™ Service Assurance solutions provide contextual real-time analytics of service, network and application performance. Arbor Smart DDoS Protection by NETSCOUT products protect against attacks that threaten availability and advanced threats that infiltrate networks to steal critical corporate resources.