DDoS Attack with 25.3 Billion Requests Abused HTTP/2 Multiplexing

Record DDoS Attack with 25.3 Billion Requests Abused HTTP/2 Multiplexing

Cybersecurity company Imperva has disclosed that it mitigated a dispersed denial-of-company (DDoS) attack with a whole of more than 25.3 billion requests on June 27, 2022.

According to reports, the “powerful attack,” which was directed at an unidentified Chinese telecommunications operator, peaked at 3.9 million requests per second and continued for four hours (RPS).

In a study released on September 19, Imperva stated that “attackers used HTTP/2 multiplexing, or mixing many packets into one, to deliver multiple requests at once over individual connections.”

The attack originated from a botnet that had approximately 170,000 unique IP addresses from routers, security cameras, and compromised servers spread across more than 180 nations, primarily the United States, Indonesia.

The exact same sufferer was previously specific on July 21, 2022, in a identical trend in which the attack quantity ramped up to 853.7 gigabits for every 2nd (Gbps) and 659.6 million pps above a period of time of 14 several hours.

Craig Sparling of Akamai said the company has been “relentlessly bombarded by sophisticated distributed denial-of-service (DDoS) attacks, indicating that the attack may be politically motivated amid Russia’s ongoing war against Ukraine.

“Without an preliminary handshake to make certain a legitimate connection, UDP channels can be used to ship a large volume of visitors to any host,” NETSCOUT says.

“There are no interior protections that can limit the fee of a UDP flood. As a end result, UDP flood DoS assaults are extremely perilous mainly because they can be executed with a restricted volume of methods.”