Cloudflare mitigated one of the largest DDoS attack involving 17.2 million rps

Web infrastructure and website security company Cloudflare on
Thursday disclosed that it mitigated the largest ever volumetric
distributed denial of service (DDoS) attack recorded to date.

The attack, launched via a Mirai botnet, is said to have
targeted an unnamed customer in the financial industry last month.
“Within seconds, the botnet bombarded the Cloudflare edge with over
330 million attack requests,” the company noted^[1], at one point reaching a
record high of 17.2 million requests-per-second (rps), making it
three times bigger than previously reported HTTP DDoS attacks.

Volumetric DDoS attacks are designed to target a specific
network with an intention to overwhelm its bandwidth capacity and
often utilize reflective amplification
techniques^[2] to scale their attack
and cause as much operational disruption as possible.

They also typically originate from a network of malware-infected
systems — consisting of computers, servers, and IoT devices —
enabling threat actors to seize control and co-opt the machines
into a botnet capable of generating an influx of junk traffic
directed against the victim.

In this specific incident, the traffic originated from more than
20,000 bots in 125 countries worldwide, with almost 15% of the
attack originating from Indonesia, followed by India, Brazil,
Vietnam, and Ukraine. What’s more, the 17.2 million rps alone
accounted for 68% of the average rps rate of legitimate HTTP
traffic processed by Cloudflare in Q2 2021, which is at 25 million
HTTP rps.

This is far from the first time similar attacks have been
detected in recent weeks. Cloudflare noted that the same Mirai
botnet was used to strike a hosting provider with an HTTP DDoS
attack that peaked a little below 8 million rps.

Separately, a Mirai-variant botnet was observed launching over a
dozen UDP and TCP-based DDoS attacks that peaked multiple times
above 1 Tbps. The company said the unsuccessful attacks were aimed
at a gaming company and a major Asia Pacific-based internet
services, telecommunications, and hosting provider.

“While the majority of attacks are small and short, we continue
to see these types of volumetric attacks emerging more often,”
Cloudflare said. “It’s important to note that these volumetric
short burst attacks can be especially dangerous for legacy DDoS
protection systems or organizations without active, always-on
cloud-based protection.”