By Richard Wallace, Cyber Security Threat Analyst, Vercara
Today’s malicious attackers are constantly adapting and shifting their efforts to stay one step ahead of cybersecurity professionals, with the first half of 2024 revealing a significant increase in one attack type: DDoS attacks.
Distributed Denial of Service, or DDoS, attacks are a popular and devastating form of cybercrime in which threat actors flood servers and networks with traffic to prevent new users from accessing a website.
According to Vercara’s Bi-annual DNS and DDoS Traffic and Trends Analysis reports, the first half of 2024 recorded a staggering 186% increase in DDoS attacks. Specifically, 75% of these DDoS attacks were carpet bomb attacks, emphasizing the rise of a new attack vector.
Carpet bomb attacks are intended to be hard-to-mitigate attacks that spread malicious traffic across multiple IP addresses at once, making them difficult for security teams to address.
With these new attacks on the rise security professionals must understand what the new methods being leveraged by threat actors look like, what is driving these attacks, such as rising geo-political tensions, and how to mitigate future attacks.
What is a Carpet Bomb Attack?
When looking to improve security posture and prevent carpet bomb attacks, it is important to first understand how they differ from traditional DDoS attacks. Specifically, while DDoS attacks typically target a single entity, carpet bomb style attacks expand the target from one to many by targeting an entire network block.
Similar to its name in actual warfare, these attacks are specifically designed to cause the maximum amount of damage possible. This could lead to substantial financial losses for victims, as well as a loss of consumer trust and a damaged brand reputation.
While it is expected an attack capable of causing this level of significant damage would be a large-scale mega attack, they are classified as “ankle biters,” or smaller attacks that do not require a large infrastructure to produce a high volume.
When initiating carpet bomb attacks, attackers resort to small botnets with compromised IoT devices which allow them to stay under the radar while maximizing impact. In addition, these attacks act like “whack-a-mole,” so, when security professionals are successfully able to mitigate one attack, another pops up and so on.
Therefore, malicious actors are shifting to these attacks to stay ahead of defenders, while also constantly changing what they attack and what vectors they target.
Hacktivism: A Key Driver for Cybercrime
Once developing an understanding for trending attack types to protect against, it is also important to understand why cybercriminals are choosing to target certain companies and organizations. While motivations are commonly financial, they can also be political.
Hacktivism, a form of online activism that uses cybercrime to influence political action, is the primary reason behind the rise in DDoS attacks, particularly carpet bomb attacks.
With geopolitical tensions spreading across different regions, the rise in hacktivist activity is correlated to military conflict, using these attacks as a banner for their message. For example, NoName, one of the most prolific hacktivist groups, has targeted Taiwan due to comments from Taiwan’s president.
Additionally, the rise of AI and easy to download open-source scripts has made it easier for non-skilled individuals to take advantage of basic coding scripts to drive DDoS attacks. In tandem with the increase in political activity and democratized technology, today, organizations are facing unprecedented challenges.
Beyond the disruption of services, hacktivists are also leveraging DDoS attacks to harm an organization’s reputation. For instance, if a customer of a bank goes online to use its website, only to see it is constantly down from an attack, it will erode the customer’s trust in the institution. By harming an organization’s reputation, cybercriminals apply pressure on businesses and government agencies to move the needle towards their cause.
How to DDoS-Proof Your Organization
After security teams understand how and why threat actors are targeting their organizations, they can begin to implement security solutions to best protect themselves from the threat of DDoS attacks.
One of the best ways organizations can protect their systems, data, and reputation is through third-party security operations center (SOC) support, especially one that specializes in DDoS. As DDoS tactics constantly change, experts in this type of attack are critical to ensuring a strong security strategy.
Next, security teams must ensure their company’s policies and procedures are up-to-date to allow for detection and mitigation. Security teams should have check lists that address each step individually, updating, validating, and rehearsing them at least twice per year.
Lastly, ahead of significant events, organizations should prepare with load and balance testing to validate the strength of their infrastructure.
Looking Ahead: Expectations for the Remainder of 2024 and beyond
Though the 2024 election will be wrapping up in the coming months, political tensions will continue to persist, and hacktivism doesn’t only occur on a 4-year cycle. Organizations must constantly be on the lookout for potential vulnerabilities and need to prioritize protecting their data and reputation from hacktivist-led DDoS attacks.
Additionally, as carpet bombing continues to be a prevalent threat, it is critical that defenders flip the script to stay one step ahead and safeguard their organizations from future attacks.
##
ABOUT THE AUTHOR
Richard Wallace is a Cyber Security Threat Intelligence Analyst at Vercara who has extensive experience in intelligence, data analytics, and security. At Vercara, he researches and develops reports on cyber threats, trends, and geopolitical issues surrounding data protection and dynamic threat environments. Richard started his career with the United States Army as a Geospatial Intelligence Technician Warrant Officer with assignments with the 1st and 2nd Infantry Divisions, U.S. Army Europe as well as the National Geospatial-Intelligence Agency. Richard has three combat deployments in support Operation Iraqi Freedom.
