Internet services giant Cloudflare says it mitigated a record number of DDoS attacks in 2024, recording a massive 358% year-over-year jump and a 198% quarter-over-quarter increase. However, 2025 is looking to be an even bigger problem for online entities and companies, with Cloudflare already responding to 20.5 million DDoS attacks in just the first quarter of 2025. "Of the 20.5 million DDoS attacks, 16.8M were network-layer DDoS attacks, and of those 6.6M targeted Cloudflare's network infrastructure directly," explains Cloudflare. Meanwhile, the trend of hyper-volumetric attacks continued unabated, with Cloudflare recording over 700 attacks that surpassed bandwidths of 1 Tbps (terabit per second) or packet rates of 1 billion packets per second. Cloudflare says it identified two emerging threats in 2025 Q1, namely Connectionless Lightweight Directory Access Protocol (CLDAP) and Encapsulating Security Payload (ESP) reflection/amplification attacks. One attack highlighted in Cloudflare's report, which occurred during 2025 Q1, concerns a US-based hosting provider that offers services to multiplayer gaming servers for Counter-Strike GO, Team Fortress 2, and Half-Life 2: Deathmatch. The previous record, also reported by Cloudflare, was a 5.6 Tbps DDoS attack attributed to a Mirai-based botnet comprising 13,000 devices. These attacks include Cloudflare itself, whose infrastructure was targeted directly in 6.6 million attacks over an 18-day multi-vector campaign. Gaming servers are popular targets for DDoS attacks, as the disruption can be highly damaging and impactful for publishers and entire player communities. The attack was 'hyper volumetric,' reaching 1.5 billion packets per second, though Cloudflare says it was still mitigated. The hyper-volumetric attacks that fall into these categories averaged eight daily during the year's first quarter, and the total count doubled compared to the previous quarter. Cloudflare explains that UDP in CLDAP requires no handshake, allowing IP spoofing, which the attackers exploit by forging the source IP address to reflect massive amounts of traffic to their target.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 28 Apr 2025 14:05:00 +0000