Report: Geopolitical unrest fuels surge in DDOS attacks
April 25, 2024
NetScout Systems has released findings from its H2 2023 DDoS Threat Intelligence Report that dissects trends and attack methodologies adversaries use against service providers, enterprises, and end-users. The information cited in the report is gathered from NetScout’s internet visibility at a global scale, collecting, analysing, prioritising, and disseminating data on DDoS attacks from 214 countries and territories, 456 vertical industries, and more than 13,000 Autonomous System Numbers (ASNs).
Driven by tech-savvy and politically motivated hacktivist groups and an increase in DNS water torture attacks, NetScout observed more than 7 million DDoS attacks in the second half of 2023, representing a 15 per cent increase from the first half of the year.
Hacktivism Increases Ten-Fold
Distributed denial-of-service (DDoS) hacktivism transcended geographic borders during the past year, exemplifying a shift in the global security landscape. Groups like NoName057(016) and Anonymous Sudan, as well as lone hackers and small collectives, are increasingly using DDoS to target those ideologically opposed to them, for example:
- Peru experienced a 30 per cent increase in attacks tied to protests of former Peruvian President Fujimori’s release from prison on December 6th
- Poland experienced a surge in attacks at the end of 2023 associated with a regime change and statements reaffirming Poland’s support of Ukraine in the Russia-Ukraine conflict
- Anonymous Sudan attacked X (formerly Twitter) to influence Elon Musk regarding Starlink service in Sudan, and it attacked Telegram for suspending its main channel
NoName057(016), Anonymous Sudan, and Killnet have taken credit for DDoS attacks in Ukraine, Russia, Israel, and Palestine targeting communications infrastructure, hospitals, and banks. Daily attacks from hacktivists increased more than tenfold between the first and second halves of 2023. NoName057(016) topped the list of DDoS adversaries in 2023, targeting 780 websites across 35 countries.
Water Torture Attacks Rise
Targeting critical systems at the heart of the Internet’s control plane, DNS (Domain Name System) water torture attacks have been on the rise since the end of 2019. DNS query floods designed to overwhelm authoritative DNS servers experienced a massive 553 per cent increase from H1 2020 to H2 2023. Rather than targeting one website or server, adversaries go after entire systems, resulting in even more damage.
Gaming and Gambling Targeted
NetScout findings point to gaming – and the gambling associated with gaming – as a primary target for DDoS attacks. Threat actors are drawn to the sector’s substantial financial value and the goal of disrupting competitors, especially during online eSports tournaments. Historically, 80-90 per cent of all DDoS attacks are related to gaming and gambling. NetScout assessed attacks on enterprises in these sectors, determining that more than 100,000 DDoS attacks were deployed against those in gaming, and over 20,500 were made against those tied to gambling in 2023.
In addition, based on NetScout’s observations of the DDoS threat landscape, approximately 1 per cent of DDoS attacks are suppressed from originating networks.
“Global adversaries have become more sophisticated in the past year attacking websites and overloading servers to lockout customers and inflict digital chaos to influence geopolitical issues,” commented Richard Hummel, senior threat intelligence lead, NetScout. “The relentless barrage of DDoS threats drives up costs and creates security fatigue for network operators. They cannot safeguard their digital assets without the proper advanced DDoS protection leveraging predictive, real-time threat intelligence.”