Lumen research reveals rise in complex DDoS attacks

Quarterly DDoS report expanded to include data from API and application protection partner ThreatX. #pressrelease

April 25, 2023

2 Min Read

DENVER – Lumen Technologies® (NYSE: LUMN) today released its latest report detailing Distributed Denial of Service (DDoS) mitigations in Q1 2023. For the first time, the report also includes Q1 data from Lumen's API and application protection partner, ThreatX. The combined report – which examines DDoS attacks that Lumen mitigated for its customers and application requests that ThreatX blocked for its customers – provides a more holistic view of the overall threat landscape.

Notable Findings: Complex Attacks on the Rise

  • Domain Name System (DNS) water torture attacks

    • Twenty six percent of all single-vector attacks in Q1 utilized DNS amplification – a 417% increase over the same quarter last year. Of these, a sophisticated form of DNS amplification known as a "DNS water torture attack" was the most common.

    • DNS water torture is a complex attack vector designed to overwhelm the resources of an authoritative DNS server and prevent it from responding to valid DNS queries. A comprehensive DDoS mitigation solution is necessary to defend against DNS water torture attacks.

  • Complex, multi-vector mitigations

    • Multi-vector attacks are not new, and threat actors deploy different combinations of vectors because they are more difficult to mitigate. In Q1, Lumen mitigated an attack that utilized a record six different vectors including DNS Amplification, ICMP, TCP RST, TCP SYN/ACK Amplification and UDP amplification. Because each vector targets specific ports, protocols and systems, these complex attacks are significantly more difficult to mitigate.

Other Highlights

  • The volume of DDoS attacks continues to be high. Lumen mitigated more than 8,600 DDoS attacks in Q1 – a 40% increase year-over-year and the second-busiest quarter in two years.

  • Consistent with previous observations, DDoS attack activity increased around U.S. holidays. In Q1, the busiest holiday for threat actors was Martin Luther King, Jr. Day. Lumen researchers theorize that attackers focus their efforts on or around holidays because staffing levels are typically lower.

  • Real-time bot protection. ThreatX blocked 25 billion application requests in Q1, representing 42% of all its customers' traffic. Of the blocked traffic, more than 30% came from bots. This volume underscores the need for real-time API and application protection and tightly integrated bot mitigations solutions as part of a comprehensive security strategy.

  • The telecommunications industry continues to be highly targeted. Eighty-five percent of the largest 1,000 DDoS attacks that Lumen mitigated in Q1 targeted the telecommunications industry. In addition, more than 700,000 of the application requests that ThreatX blocked targeted telecom customers – the third most-targeted industry after banking and advertising.

Read the full press release here.


Subscribe and receive the latest news from the industry.
Join 62,000+ members. Yes it's completely free.

You May Also Like