Malicious DDoS attacks climb 203% – Radware H1 2022 report

Malicious DDoS attacks climbed 203% compared to the first six months of 2021. This was revealed by the First Half 2022 Global Threat Analysis Report released by Radware® (NASDAQ: RDWR), a leading provider of cyber security and application delivery solutions.

The mid-year report leverages intelligence provided by network and application attack activity sourced from Radware’s Cloud and Managed Services, Global Deception Network, and threat research team.

LifeLock by Norton

Sign Up

It only takes a few minutes to enroll.

We Scan

We look for threats to your identity.

We Alert^†

We alert you of potential threats by text, email, phone or mobile app.

We Resolve

If you become a victim of identity theft, a U.S.-based Identity Restoration Specialist will work to fix it.

We Reimburse

We’ll reimburse funds stolen due to identity theft up to the limit of your plan.^†††

Start membership

“The threat landscape saw a marked shift in the first half of 2022,” said Pascal Geenens, director of threat intelligence for Radware.

“As Russia invaded Ukraine, the cyber focus changed. It shifted from the consequences of the pandemic, including an increase in attack surfaces driven by work from home and the rise of underground crime syndicates, to a ground swell of DDoS activity launched by patriotic hacktivists and new legions of threat actors.”

DDoS attacks rise dramatically

The first six months of 2022 were marked by a significant increase in DDoS activity across the globe. Attacks ranged from cases of hacktivism to terabit attacks in Asia and the United States.

The number of malicious DDoS attacks climbed 203% compared to the first six months of 2021.
There were 60% more malicious DDoS attacks during the first six months of 2022 than during the entire year of 2021.
In May 2022, Radware mitigated a volumetric carpet-bombing attack, which represented a total volume of 2.9 PB. The attack lasted 36 hours, peaking at 1.5 Tbps with a sustained attack rate of more than 700 Gbps for more than eight hours. The combination of duration, volume, and average/sustained attack rates makes this one of the most significant DDoS attacks on record.

Patriotic hacktivism surges

During the first half of 2022, patriotic hacktivism increased dramatically.

Both established and newly formed pro-Ukrainian and pro-Russian cyber legions aimed to disrupt and create chaos by stealing and leaking information, defacements, and denial-of-service attacks.
DragonForce Malaysia, a hacktivist operation targeting Middle Eastern organizations in 2021 made a return in 2022. Its recent campaigns were political responses to national events. OpsBedil Reloaded occurred following events in Israel, and OpsPatuk was launched in reaction to public comments made by a high-profile political figure in India.
Major information and communication networks in the Philippines, including CNN, news network ABS-CBN, Rappler, and VERA Files, were the target of DDoS attacks in connection with the country’s 2022 general elections.

“No organization in the world is safe from cyber retaliation at this time,” Geenens warns. “Online vigilantes and hacktivists could disrupt wider security efforts driven by nations and authorities. New legions of actors could introduce extreme unpredictability for intelligence services, creating a potential for spillover and wrongful attribution that could eventually lead to an escalation of the cyber conflict.”

Ransom denial of service maintains its ground

Outside of the war realm, other cybercrime groups re-emerged and went on with business.

During the first half of 2022, a renewed campaign of RDoS attacks by a group claiming to be REvil emerged. This time the group was not only sending warning notes for ransom before the attack started, but also embedded the ransom note and demands within the payload.
In May 2022, Radware discovered several ransom demand letters from a group posing as Phantom Squad.

Retail and high-tech top industries for most web attacks

During the first six months of 2022, Radware observed an increase in malicious transactions targeting online applications, dominated by predictable resource location and injection attacks.

The number of malicious web application transactions grew by 38%, compared to the first six months of 2021, surpassing the total number of malicious transactions recorded in 2020.
Predictable resource location attacks accounted for almost half (48%) of all attacks followed by code injection (17%) and SQL injection (10%).
The most attacked industries were retail and wholesale trade (27%) and high tech (26%). Carriers and SaaS providers ranked third and fourth, shouldering 14% and 7% of the attacks respectively.

Resources

Radware’s complete First Half 2022 Global Threat Analysis Report can be downloaded here. Other resources include:

Blog: This was H1 2022: Part 1 – The Fight Against Cybercrime
Blog: This was H1 2022: Part 2 – Cyber War
Radware’s Quarterly DDoS and Application Threat Analysis Hub

About Radware

Radware^® (NASDAQ: RDWR) is a global leader of cyber security and application delivery solutions for physical, cloud, and software defined data centers. Its award-winning solutions portfolio secures the digital experience by providing infrastructure, application, and corporate IT protection, and availability services to enterprises globally.

Radware’s solutions empower enterprise and carrier customers worldwide to adapt to market challenges quickly, maintain business continuity, and achieve maximum productivity while keeping costs down. For more information, please visit the Radware website.

Radware encourages you to join our community and follow us on: Facebook, LinkedIn, Radware Blog, Twitter, YouTube, and Radware Mobile for iOS and Android.

©2022 Radware Ltd. All rights reserved. Any Radware products and solutions mentioned in this press release are protected by trademarks, patents, and pending patent applications of Radware in the U.S. and other countries. For more details, please see: https://www.radware.com/LegalNotice/. All other trademarks and names are property of their respective owners.

THIS PRESS RELEASE AND THE RADWARE FIRST HALF 2022 GLOBAL THREAT ANALYSIS REPORT ARE PROVIDED FOR INFORMATIONAL PURPOSES ONLY. THESE MATERIALS ARE NOT INTENDED TO BE AN INDICATOR OF RADWARE’S BUSINESS PERFORMANCE OR OPERATING RESULTS FOR ANY PRIOR, CURRENT, OR FUTURE PERIOD.

Radware believes the information in this document is accurate in all material respects as of its publication date. However, the information is provided without any express, statutory, or implied warranties and is subject to change without notice.

The contents of any website or hyperlinks mentioned in this press release are for informational purposes and the contents thereof are not part of this press release.

Safe Harbor Statement

This press release includes “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995. Any statements made herein that are not statements of historical fact, including statements about Radware’s plans, outlook, beliefs, or opinions, are forward-looking statements. Generally, forward-looking statements may be identified by words such as “believes,” “expects,” “anticipates,” “intends,” “estimates,” “plans,” and similar expressions or future or conditional verbs such as “will,” “should,” “would,” “may,” and “could.” For example, when we say that no organization in the world is safe from cyber retaliation at this time, we are using a forward-looking statement. Because such statements deal with future events, they are subject to various risks and uncertainties, and actual results, expressed or implied by such forward-looking statements, could differ materially from Radware’s current forecasts and estimates. Factors that could cause or contribute to such differences include, but are not limited to: the impact of global economic conditions and volatility of the market for our products; natural disasters and public health crises, such as the coronavirus disease 2019 (COVID-19) pandemic; a shortage of components or manufacturing capacity could cause a delay in our ability to fulfill orders or increase our manufacturing costs; our business may be affected by sanctions, export controls, and similar measures, targeting Russia and other countries and territories, as well as other responses to Russia’s military conflict in Ukraine, including indefinite suspension of operations in Russia and dealings with Russian entities by many multi-national businesses across a variety of industries; our ability to successfully implement our strategic initiative to accelerate our cloud business; our ability to expand our operations effectively; timely availability and customer acceptance of our new and existing solutions; risks and uncertainties relating to acquisitions or other investments; the impact of economic and political uncertainties and weaknesses in various regions of the world, including the commencement or escalation of hostilities or acts of terrorism; intense competition in the market for cyber security and application delivery solutions and in our industry in general, and changes in the competitive landscape; changes in government regulation; outages, interruptions, or delays in hosting services or our internal network system; compliance with open source and third-party licenses; the risk that our intangible assets or goodwill may become impaired; our dependence on independent distributors to sell our products; long sales cycles for our solutions; changes in foreign currency exchange rates; undetected defects or errors in our products or a failure of our products to protect against malicious attacks; the availability of components and manufacturing capacity; the ability of vendors to provide our hardware platforms and components for our main accessories; our ability to protect our proprietary technology; intellectual property infringement claims made by third parties; changes in tax laws; our ability to realize our investment objectives for our cash and liquid investments; our ability to attract, train, and retain highly qualified personnel; and other factors and risks over which we may have little or no control. This list is intended to identify only certain of the principal factors that could cause actual results to differ. For a more detailed description of the risks and uncertainties affecting Radware, refer to Radware’s Annual Report on Form 20-F, filed with the Securities and Exchange Commission (SEC) and the other risk factors discussed from time to time by Radware in reports filed with, or furnished to, the SEC. Forward-looking statements speak only as of the date on which they are made and, except as required by applicable law, Radware undertakes no commitment to revise or update any forward-looking statement in order to reflect events or circumstances after the date any such statement is made. Radware’s public filings are available from the SEC’s website at www.sec.gov or may be obtained on Radware’s website at www.radware.com.

– Globe Newswire, Mahwah, NJ

_______________________