Distributed denial-of-service (DDoS) attacks, a type of cyberattack that aims to take down websites by overwhelming their servers with malicious traffic, have become more common and destructive in 2023, affecting various sectors and organizations around the world.
According to a report from cybersecurity company StormWall, the total number of DDoS attacks grew 47% in the first quarter of 2023 compared to the same period last year. Attacks on the finance sector and e-commerce companies saw the biggest growth, the report noted.
DDoS attacks have also gotten longer and larger, according to Cloudflare, a company that provides DDoS protection. Part of the reason for this is that botnets, networks of malware-infected computers controlled by an attacker, are much easier to create and deploy for attacks.
“Now you can build a 14-million-strong botnet by infecting lightbulbs and thermostats and fridges and things,” Erick Galinkin, principal researcher at Rapid7, told Axios. “The attack surface for creating the bots that generate the traffic is much larger than it ever has been.”
Some hackers have also started combining the ease of launching a DDoS attack with the financial payoff offered by ransomware. Galinkin said he’s spotted ransomware gangs and data theft extortionist groups launching DDoS attacks against organizations while they weighed whether to pay a ransom to decrypt their files or prevent a data leak.
One of the most recent victims of this tactic is Archive of Our Own (AO3), a popular fanfiction platform that has been experiencing prolonged, intermittent outages since Monday as a cyberattack targets its servers. A group claiming to be Anonymous Sudan has taken credit for the attack, and is demanding a ransom of $30k worth of Bitcoin to stop the operation.
The AO3 team is currently trying to defend against the attack and restore the platform, warning that users may experience various error messages or encounter display issues with the site layout in the meantime. The company said that because DDoS attacks don’t compromise private user data, there’s no need for users to change their password in response to the outage.
Another notable target of DDoS attacks in 2023 was Microsoft, which confirmed last month that a DDoS attack caused outages across its Azure, Outlook and OneDrive services. The Cybersecurity and Infrastructure Security Agency also released an advisory right before the holiday weekend warning about reports of several DDoS attacks targeting “multiple organizations in multiple sectors.”
DDoS attacks are not a new phenomenon, but they have become more sophisticated and impactful over time. Experts advise organizations to implement DDoS mitigation strategies and monitor their network traffic for any signs of abnormal activity.
