Lumen research reveals 60% growth of a known, preventable DDoS attack vector

New intelligence from Black Lotus Labs regarding the proliferation of Connectionless Lightweight Directory Access Protocol (CLDAP) reflectors – a known attack vector that is easily prevented with well-documented best practices.

The Q3 2022 Distributed Denial of Service (DDoS) report, which provides the latest data and trends from the Lumen DDoS mitigation platform.

Black Lotus Labs discovered more than 12,000 CLDAP services are open to the internet – a 60% increase over the past year.

Read the Black Lotus Labs blog titled "CLDAP Reflectors on the Rise Despite Best Practices" and the Lumen Q3 DDoS report.

CLDAP is an essential service in Microsoft environments. When improperly configured to expose the service to the internet, CLDAP can carry a bandwidth amplification factor of up to 70 times the volume of traffic sent. This makes it an enticing target for cybercriminals launching DDoS attacks.

As soon as the CLDAP vulnerability was discovered in 2016, best practices for mitigating the threat were published; and yet, six years later, the number of exposed CLDAP reflectors is on the rise.

Using Lumen's global network visibility, Black Lotus Labs tracks CLDAP reflectors with a proprietary validator that registers distinct IPs that are open to reflection. This is a more precise assessment of the breadth of reflectors than has previously been available to the industry.

Notable findings:

Lumen mitigated 5,547 attacks in Q3 – a 21% increase over Q2 – and the largest bandwidth attack scrubbed was 493 Gbps. This is nearly half the size of the largest mitigation in Q2 which, at 1.06 Tbps, was Lumen's largest to date.

Although Session Initiation Protocol (SIP) attacks only accounted for 3% of all mitigations, this attack vector – which targets VoIP infrastructure – remains of interest due to a dramatic upward trend over the past year. This quarter saw a 59% increase over Q2.

The top five targeted industries were Telecommunications, Gaming, Software and Technology, Government and Finance.

Of the 5,500+ attacks Lumen mitigated in Q3, nearly 40% targeted a single government customer. Despite the bombardment and a concentrated effort around July 4, the customer experienced no downtime.