Latest Link11 DDoS Report shows that DDoS attack volumes increased by 50% in Q2 2018

New report reveals DDoS attack volumes increased to an average 3.3 Gbps and nearly half are multi-vector, as attackers increasingly strike outside of normal business hours.

Link11, a leader in cloud-based anti-DDoS protection, today releases its Q2 DDoS Report revealing that attack volumes increased by 50% to an average of 3.3 Gbps during May, June and July 2018, compared to 2.2 Gbps during the previous quarter. Attacks are also becoming increasingly complex, with 46% of incidents using two or more vectors.

While attack volumes increased, the Link11 Security Operation Center (LSOC) recorded a 36% decrease in the overall number of attacks.  There was a total of 9,325 attacks during the quarter:  an average of 102 attacks per day.

While the number of attacks decreased overall – possibly as a result of DDoS-as-a-service website Webstresser being closed down following an international police operation, both the scale and complexity of the attacks increased. The LSOC registered a 50% increase in hyper-scale attacks (80 Gbps+). The most complex attacks seen used 13 vectors in total.

The report revealed that threat actors targeted organisations most frequently between 4pm CET and midnight Saturday through to Monday, with businesses in the e-commerce, gaming, IT hosting, finance, and entertainment/media sectors being the most affected.

Aatish Pattni, Regional Director UK & Ireland for Link11, commented: “Attacks in Q2 2018 continued to grow in scale and complexity, despite the successful shutting-down of the Webstresser DDoS-for-hire service in late April. Nearly half of attacks were multi-vector, making them harder to defend against, and with the rapid growth in ‘hyper attacks’ with volumes of over 80 Gbps, we must now consider these large, complex attacksto be the new normal.”

“It’s only a matter of time until a new DDoS-for-hire service emerges to replace Webstresser, so attacks will inevitably increase over the coming months. Given the scale of the threat that organizations are facing, and the fact that the attacks are deliberately aimed at causing maximum disruption, it’s clear that businesses need to deploy advanced techniques to protect themselves against DDoS exploits,” added Pattni.

The report reveals that high volume attacks were ramped up via Memcached reflection, SSDP reflection and CLDAP, with the peak attack bandwidth recorded at 156 Gbps.  Other key findings from the Q2 report include:

• The total duration of attacks during the quarter was 1,221 hours
• 17% of attacks used two vectors, while 16% used three
• The most frequently observed attacks were UDP floods (59.7%), TCP SYN floods (3.3%) and ICMP floods (0.9%)
• Memcached was the most used reflection amplification technique, with 773 attacks observed using this technique, highlighting that Memcached is still an issue. The SSDP reflection technique generated the greatest proportion of DDoS packets

For more information, statistics and analyses download the full Link11 DDoS Report Q2 2018.