Pierluigi Paganini
January 22, 2025
Cloudflare announced that during the week of Halloween 2024, it autonomously detected and blocked a 5.6 Terabit per second (Tbps) DDoS attack, which is the largest attack ever reported. The previous largest DDoS attack blocked by Cloudflare occurred in October 2024 and peaked at 3.8 Tbps.
The attack occurred on October 29, when a Mirai-variant botnet composed of 13,000 IoT devices launched a 5.6 Tbps UDP DDoS attack against a Cloudflare Magic Transit customer, an Internet service provider (ISP) from Eastern Asia.
The record-breaking attack lasted only 80 seconds, the company pointed out that the detection and mitigation were fully automated without human intervention.
“While the total number of unique source IP addresses was around 13,000, the average unique source IP addresses per second was 5,500. We also saw a similar number of unique source ports per second. In the graph below, each line represents one of the 13,000 different source IP addresses, and as portrayed, each contributed less than 8 Gbps per second.” reads the report published by Cloudflare. “The average contribution of each IP address per second was around 1 Gbps (~0.012% of 5.6 Tbps).”
In 2024, Cloudflare blocked 21.3 million DDoS attacks, which is a 53% rise from 2023, with 420 hyper-volumetric attacks in Q4 and a 1,885% surge in 1 Tbps+ attacks.
According to the report, 73% of HTTP DDoS attacks in 2024 were launched from known botnets, swiftly blocked due to Cloudflare’s vast network. The rest included fake browsers (11%), unusual attributes (10%), and generic floods (8%).
This week, Qualys researchers detailed a new Mirai botnet variant, named Murdoc Botnet, that targets vulnerabilities in AVTECH IP cameras and Huawei HG532 routers, the Qualys Threat Research Unit reported.
The botnet has been active since at least July 2024, the experts discovered that over 1300 IPs were found active on this campaign. Most of the infected systems are in Malaysia, Thailand, Mexico, and Indonesia.
Researchers also found over 100 servers distributing Mirai malware and communicating with compromised IPs, indicating the campaign is ongoing.
“Mirai malware, here dubbed as Murdoc Botnet, is a prominent malware family for *nix systems. It mainly targets vulnerable AVTECH and Huawei devices. This botnet also uses some existing exploits (CVE-2024-7029, CVE-2017-17215) to download the next-stage payloads.” reads the advisory.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
