With a record-breaking 20.5 million Distributed Denial of Service (DDoS) attacks prevented in the first quarter alone, a 358% rise over the same period last year, Cloudflare has reported a historic spike in cyberattacks to start 2025. Hong Kong emerged as the primary source of attack traffic, with Hetzner (AS24940) remaining the largest source of HTTP DDoS attacks among autonomous systems. This explosive growth nearly equals the total number of attacks Cloudflare mitigated in all of 2024, underscoring a dramatic escalation in both the volume and intensity of DDoS threats. In April 2025, Cloudflare’s systems automatically detected and mitigated the largest packet-rate attack on record, peaking at 4.8 billion packets per second (Bpps) – approximately 52% larger than the previous 3.15 Bpps record. “The threat landscape has evolved dramatically in just one quarter,” said Cloudflare in their Q1 2025 DDoS Threat Report. This massive attack, originating from 147 countries, targeted the U.S.-based hosting provider and was part of a sustained campaign that also included a separate 6.5 terabits-per-second (Tbps) flood, matching the highest bandwidth attack ever publicly disclosed. To help combat these threats, Cloudflare provides a free DDoS Botnet Threat Feed for service providers. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The report identified SYN flood as the most prevalent attack vector, followed by DNS floods and Mirai-generated attacks. CLDAP (Connectionless Lightweight Directory Access Protocol) uses UDP instead of TCP, allowing attackers to spoof source IP addresses in small queries that trigger large responses to victims. SYN floods exploit the TCP three-way handshake mechanism by sending numerous connection requests with spoofed source IP addresses, leaving servers with half-open connections that exhaust resources. This surge underscores a dramatic shift in the global threat landscape, with attackers deploying more sophisticated and larger-scale campaigns than ever before. The record-breaking 4.8 Bpps attack lasted just 35-45 seconds, highlighting the need for always-on, automated protection.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 29 Apr 2025 12:20:04 +0000