Major DDoS attacks increasing after invasion of Ukraine

Rate of attacks

In separate reports, Cloudflare and Kaspersky Lab analyzed the growth of DDoS attacks during the first quarter of 2022. Cloudflare's report broke down the data by type of attack and tracked the growth year over year (YoY) and quarter over quarter (QoQ), as well as which industries were most heavily targeted by each kind.

The company found that application-layer attacks went up by 164% YoY and 135% QoQ and that network-layer attacks increased 71% YoY but fell by 58% QoQ.

Cloudflare also found that the size of attacks increased. The number of attacks using over 10 million packets per second grew by more than 300% QoQ and attacks over 100 billion bits per second rose by 645% QoQ.

Kaspersky's report found that overall, there was a 450% increase in DDoS attacks from Q1 2021 to Q1 2022. The report also found that the duration of these attacks grew, with the average DDoS attack duration in Q1 2022 being nearly 8000% higher than the same figure for 2021.

However, Kaspersky did note that there was a far lower number of attacks prior to Russia's invasion, which began Feb. 24.

"The reason for this growth is obvious: the crisis in Ukraine led to a cyberwar, which could hardly fail to impact the statistics," the report stated. "Looking at the distribution of DDoS attacks by week, we see that the peak of new attacks occurred in the eighth week of 2022, that is, February 21 - 27."

Kaspersky explained what may have led to the potentially skewed trend for 2022.

"There were relatively few attacks before late February, and without the spike in DDoS activity at the end of the month we would have seen a drop relative to the previous quarter," the report stated. "The hacktivist nature of the attacks was also responsible for the sharp decline in their number towards mid-March: those initially driven by emotion had calmed down, and infosec companies published warnings against taking part in such attacks. As a result, the number of hacktivists decreased."

Charts showed that prior to the spike in late February, DDoS attacks in Q1 2022 were below the number for Q4 2021.

Alexander Gutnikov, threat analyst at Kaspersky, provided context for the numbers.

"Usually, January features more attacks than December during the previous year," Gutnikov said. "The drop in attacks we witnessed in January this year is unusual. Nevertheless, in January 2022 we have seen 1.5 times more attacks than in January last year. Furthermore, last year's December attacks dynamics were anomalous in their high volume. So the drop in January is relative."

Targeted nations

In addition to Ukraine, several allied nations have reported DDoS attacks, including the U.K., Italy, Romania and the United States. Cybersecurity vendors had warned that Russia would likely retaliate against economic sanctions with a range of cyber attacks.

Killnet is one of the key pro-Russia threat groups launching DDoS attacks on foreign nations such as Italy and Romania, as well as the U.S. The group also claimed credit for an attack on Bradley International Airport that attempted to take down the Connecticut Airport Authority website. Killnet even went so far as to declare war on 10 countries in May.

It isn't just pro-Russian threat groups that have ramped up DDoS activity; several attacks by pro-Ukraine actors have been reported against Russia and Belarus.

Cloudflare found that "Russian Online Media companies were the most targeted industries within Russia in Q1. The next most targeted was the Internet industry, then Cryptocurrency, and then Retail."

DDoS attacks haven't just targeted critical infrastructure and government services. These attacks continue to impact entities on the commercial side as well.

The largest HTTPS DDoS attack ever targeted a cryptocurrency launchpad, according to Cloudflare. The attack came from data centers that generated over 15 million requests per second on the network.

In Q1, Cloudflare found network-layer and application layer DDoS attacks targeted the telecommunications industry most, followed by gaming/gambling and then the information technology and services industry.

While DDoS attacks are often seen as a temporary nuisance, they can be costly. Columbia Wireless, a high-speed internet service provider in Canada, lost 25% of its business due to a DDoS attack at the beginning of May.