Saudi Arabia
The second half of 2021 ushered in a new focus by adversaries, who launched direct-path (non-spoofed) DDoS attacks using botnets and TCP-based floods. This coincided with a drop in DNS and CLDAP amplification, resulting in a decrease in attacks across most countries and regions. The turning point for this decline occurred just before Omicron was discovered, as COVID-19 restrictions were easing and people began returning to physical offices and classrooms. With less time to engage in malicious activity resulting in fewer DDoS attacks, threat actors certainly lend credence to the proverb that idle hands are the devil’s workshop.
Adversaries launched more than 9.7 million DDoS attacks in 2021, just 3% shy of the record-breaking 10 million seen in 2020 and a whopping 14% more than seen pre-pandemic in 2019. So although it’s tempting to simply look at the decrease in overall attacks as threat actors resting on their laurels, the reality is that attackers are innovating and adapting new techniques and methodologies to strengthen and monetize their nefarious behavior.
Max Multivector Attack
Max number of vectors seen in a single attack
20
Attack Vectors Used
1. bittorrent amplification
2. cldap amplification
3. dns
4. dns amplification
5. icmp
6. mdns amplification
7. memcached amplification
8. ms sql rs amplification
9. netbios amplification
10. ntp amplification
11. openvpn amplification
12. rpcbind amplification
13. sip amplification
14. snmp amplification
15. ssdp amplification
16. tcp ack
17. tcp rst
18. tcp syn
19. tcp syn/ack amplification
20. udp flood
Top 5 Attack Vectors
Ta
TCP ACK
Number of Attacks
59,990
Np
NTP Amplification
Number of Attacks
18,121
Dn
DNS Amplification
Number of Attacks
11,152
Tk
TCP SYN/ACK Amplification
Number of Attacks
11,009
Tr
TCP RST
Number of Attacks
8,860
Top Seven Vertical Industries Under Attack
The following industry chart shows the most targeted sectors in 2H 2021 by number of attacks.
| Rank | Vertical | Frequency | Max Attack | Max Impact | Average Duration |
|---|---|---|---|---|---|
| 1 |
 Wired Telecommunications Carriers
|
2,262 | 82.44 Gbps | 15.77 Mpps | 35.9 Minutes |
| 2 |
 Other Telecommunications
|
680 | 0.1 Gbps | 0.03 Mpps | 22.6 Minutes |
| 3 |
 Data Processing, Hosting + Related Services
|
264 | 22.37 Gbps | 3.74 Mpps | 31.1 Minutes |
| 4 |
 Computer Storage Device Manufacturing
|
5 | 1.89 Gbps | 0.17 Mpps | 5.2 Minutes |
| 5 |
 Software Publishers
|
2 | 0.05 Gbps | 0.01 Mpps | 5 Minutes |
| 6 |
 Computer and Office machine Repair and Maintenance
|
1 | 0.56 Gbps | 0.05 Mpps | 25 Minutes |
| 7 |
 Wireless Telecommunications Carriers (except Satellite)
|
1 | 0.77 Gbps | 0.21 Mpps | 8 Minutes |