DDoS Threat Intelligence

The DDoS threat landscape constantly evolves. Here are current trends to watch.

Zero-Day DDoS Attacks

What They Are: Attacks exploiting previously unknown vulnerabilities or using novel techniques.

Characteristics:

• No existing detection signatures
• Defense systems don't recognize the pattern
• Often highly effective initially

Recent Examples:

• Exploitation of new protocol vulnerabilities
• Novel application-layer attack vectors
• Abuse of newly released features in popular software

Defense Approach:

• Behavioral analysis (detect anomalies, not just known signatures)
• AI/machine learning for pattern recognition
• Rapid response and adaptation capabilities

Carpet Bombing Attacks (Bit-and-Piece)

Discovery: Identified by Nexusguard Research as "bit-and-piece attack"

What Makes It Different: Unlike traditional attacks targeting single IPs, carpet bombing distributes attack traffic across entire IP ranges.

How It Works:

• Attack traffic dispersed across hundreds or thousands of IPs
• Small amounts sent to each IP (below individual detection thresholds)
• Traffic converges toward target prefix, forming massive aggregate flow
• Polluted traffic mixed with legitimate traffic

Why It's Effective:

• Bypasses per-IP rate limiting and detection
• Legacy flow-aware devices (firewalls, IPS, IDS) fail to detect
• Can't use traditional blackholing (would block too many legitimate IPs)
• Overwhelms CSP/ISP infrastructure
• Causes high latency or network deadlock

Who's at Risk:

• Communication Service Providers (CSPs)
• Internet Service Providers (ISPs)
• Large ASN-level networks
• Organizations with distributed IP infrastructure

Defense Requirements:

• Network behavior analysis (NBA) across IP ranges
• Traffic anomaly detection at aggregate level
• Cloud-based scrubbing with massive capacity
• Real-time traffic visibility and analytics

(Source: Nexusguard, "How to Detect and Mitigate Bit-and-Piece DDoS Attack")

Ransom DDoS (RDoS) Campaigns

The Threat: Attackers demand payment to stop ongoing attacks or prevent future ones.

How It Works:

• Small "demo" attack to prove capability
• Ransom demand (typically Bitcoin payment)
• Deadline threat: "Pay within 24 hours or face larger attack"
• Escalating attacks if payment not made

Recent Activity:

• 2020: Over 100 financial institutions targeted
• Average cost to financial services: $227,865 per attack (Source: Nexusguard Financial Services Industry Guide)
• Campaigns often target multiple organizations in same industry simultaneously

Why Organizations Pay:

• Fear of prolonged downtime
• Lack of DDoS protection
• Pressure during business-critical periods

Why You Shouldn't Pay:

• No guarantee attacks will stop
• Marks you as willing to pay (future targets)
• Funds criminal operations
• May not have legal right to pay (sanctions, terrorism financing laws)

Proper Response:

• Have DDoS protection in place before attacks
• Report to law enforcement
• Activate mitigation immediately
• Communicate with customers proactively

DDoS + Ransomware Combination Attacks

The New Threat: Attackers combine DDoS with ransomware for "triple extortion."

How It Works:

• First Extortion: Encrypt data, demand ransom
• Second Extortion: Threaten to leak stolen data
• Third Extortion: Launch DDoS attacks to pressure payment

Why It's Effective:

• Multiple pressure points on the victim
• DDoS prevents business operations during ransom negotiation
• Creates urgency and panic
• Increases likelihood of payment

Defense Strategy:

• Separate teams for DDoS and ransomware response
• Don't let DDoS distract from data breach investigation
• Maintain business continuity during both attack types
• Comprehensive backup and disaster recovery plans

Hit-and-Run Attacks

What They Are: Short-duration, high-intensity attacks that end before mitigation fully activates.

Characteristics:

• Last 5-15 minutes
• High intensity (enough to cause disruption)
• Repeat throughout day/week
• Target organizations with manual mitigation activation

Why Attackers Use This Tactic:

• Evade detection thresholds
• Exploit slow mitigation activation
• Cause cumulative disruption without sustained effort
• Test defenses for future larger attacks

Defense Requirements:

• Always-on protection (no activation delay)
• Automated detection and response
• Fast mitigation activation (seconds, not minutes)

‍