A new report today from cybersecurity company Netscout Systems Inc. reveals a direct relationship between increasing internet traffic and threats and the inherent challenges faced by organizations globally, given the current network security landscape.

The Netscout DDoS Threat Intelligence Report found that since the first week of 2023, there was a 55% increase in daily carpet-bombing attacks — distributed denial-of-service attacks targeting a range of addresses or subnets — from an average of 468 a day to 724 a day.

Those attacks occurred concurrently with an increase in internet traffic, with Netscout tracking 424 terabits per second of internet peering traffic in the first half of 2023, up 5.7% over the 401 terabits per second reported at the end of 2022. The internet’s rapid growth is noted as experiencing drag, a reduction in capabilities, because of an increase in DDoS attacks, including 500% growth in HTTP/S application layer attacks and a 17% increase in DNS reflection/amplification attack volumes in the first half of the year.

The report found that there was a rebalancing away from reflection/amplification attacks toward other alerts. The first half of 2023 saw an average of 30 alerts originating from Tor nodes per day, 30 including open proxies, and more than 730 including botnets targeting Netscout’s internet service provider customers.

DNS water torture attacks – when attackers barrage the capacities of DNS servers and cause a denial of service — jumped by nearly 353% in the first half of the year, from an average of 144 daily attacks at the start of 2023 to 611 at the end of June.

Not surprisingly, geopolitical-focused DDoS attacks also rose in the first half, with groups such as Killnet continuing to target pro-Ukrainian governments and organizations. Attackers also targeted Finland and Sweden in their bids to join the North Atlantic Treaty Organization.

The report also found that internet peering traffic associated with about 40 satellite-based internet providers fell, largely because of a prominent satellite internet provider imposing bandwidth limits across their network.

The report concludes by noting that visibility has become an essential defensive tool for leveling the playing field since it can detect earlier actions, such as scanning or trying to use new attack methods, and can immediately stop attackers.

“By limiting their resources and pushing them to use only one method, we reduce their opportunities to exploit vulnerabilities,” the report states. “By imposing artificial scarcity of resources and forcing attackers into unidimensional methodologies, we help to reduce adversary options for exploitation. This is possible only with visibility.”

Image: NetScout/YouTube