DDoS attacks are down 38.8% in Q2 2021

3 years ago 423

It's each quiescent connected the DDoS front, but don't get complacent: The lull is expected, said Kaskersky, and caller onslaught vectors could spell a coming resurgence.

Kaspersky's quarterly DDoS onslaught report is 1 that its writers picture arsenic "relatively calm," but don't fto that connection fool you: There's inactive a batch of unsafe DDoS threats and caller actors waiting for their clip to strike. Not lone that, but the 2nd 4th lull is expected.

"There was a flimsy alteration successful the full fig of attacks compared to the erstwhile quarter, which is emblematic for this play and is observed annually," said Kaspersky DDoS extortion squad concern improvement manager Alexey Kiselev.

SEE: Security incidental effect policy (TechRepublic Premium)

The expected calm doesn't mean there's clip to instrumentality a break: Cybercriminals decidedly aren't, with Kaspersky reporting 2 caller imaginable DDoS onslaught vectors and a emergence successful DDoS attacks arsenic a ransomware tool.

The archetypal of the caller onslaught vectors uses the Session Traversal Utilities for Network Address Translation (NAT), oregon STUN, protocol. Traditionally utilized to representation interior IP addresses and ports from down a NAT to outer ones, attacks aboriginal successful 2021 started exploiting it to amplify postulation measurement and usage them arsenic reflectors. Kaspersky warned that much than 75,000 STUN servers crossed the globe are susceptible to this benignant of DDoS onslaught and recommends immoderate enactment utilizing STUN to instrumentality steps to support themselves earlier they're hit.

The 2nd vector Kaspersky mentioned is simply a DNS bug called TsuNAME. It functions by exploiting errors successful authoritative DNS server configuration that origin definite domains to constituent astatine each other, resulting successful an endless petition loop that floods the server and renders it useless.

While nary attackers person exploited the TsuNAME vector yet, it could springiness a boost to DDoS attacks targeting DNS servers, similar the 1 that took Microsoft services offline successful April. Kaspersky provided remediation steps for TsuNAME arsenic well: It said that authoritative DNS server owners should "regularly place and hole specified configuration errors successful their domain zone, and owners of DNS resolvers to guarantee detection and caching of looped requests."

DDoS attacks arsenic a portion of the ransomware arsenal person been gaining momentum arsenic well, Kaspersky said. A cybercriminal radical calling itself Fancy Lazarus (they are not believed to beryllium a state-sponsored APT) launched aggregate attacks against U.S.-based targets utilizing DDoS attacks, and operators of the Avaddon ransomware utilized the menace of DDoS attacks on with record encryption to extort ransoms against Australian institution Schepisi Communications.

SEE: How to negociate passwords: Best practices and information tips (free PDF) (TechRepublic)

DDoS attacks decreased by 38.8% compared to Q2 2020, and 6.5% compared to Q1 2021 but, arsenic mentioned above, those numbers are expected. Kiselev said that a cardinal origin successful predicting the 3rd 4th and beyond is cryptocurrency prices, which helium said person remained consistently high. With that successful mind, Kiselev said, "in the 3rd 4th of 2021, we besides bash not spot immoderate prerequisites for a crisp emergence oregon autumn successful the DDoS onslaught market."

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays