Malicious web application transactions skyrocket 500%

Radware, a provider of cyber security and application delivery solutions, has released its first half of the 2023 Global Threat Analysis Report.

The report leverages intelligence provided by network and application attack activity sourced from Radware's cloud and managed services, global deception network, and threat intelligence research team. It also draws from information found on Telegram, a public messaging platform often used by cybercriminals.

Pascal Geenens, Director of Threat Intelligence, Radware, comments: "The narrative for the threat landscape in 2023 is clear: a significant shift is taking place in denial-of-service attack patterns. The message to organisations is equally as clear: the focus now lies on proactively adapting to these evolving cyber threats."

"Increasing numbers of bad actors are moving up the network stack from layers 3 and 4 to layer 7 with their sights set on compromising online applications and APIs as well as essential infrastructure." 

"To launch attacks with even greater impact, control, and scale, also look for them to continue a steady transition from compromised IoT devices to cloud-based operations," says Geenes. 

The global threat landscape continues to evolve at a rapid pace. In 2023, the profile of Denial-of-Service attacks is being redefined in terms of tactics, vector, size, complexity and hacktivist offensives.

According to Radware's attack activity during the first half of 2023, malicious web application transactions skyrocketed by 500% compared to the first half of 2022, while the total number of DDoS events decreased by 33%. This points to a change in DDoS attack patterns as attacks shift from the network to the application layers.

In the second quarter of 2023, the proportion of attacks featuring a DNS Flood vector climbed almost twofold compared to the ratio of attacks in 2021 and most of 2022.

The relative number of significant attacks (greater than 100Gbps) rose sharply, increasing from 3.75x in 2022 to 10.5x in 2023, considerably outpacing the growth in small (less than 1Gbps) and mid-sized (1Gbps to 100Gbps) attacks.

Moreover, the average complexity of attacks increased with attack size. Attacks above 1Gbps, on average, had more than two dissimilar attack vectors per attack, while attacks above 100Gbps had, on average, more than eight dissimilar attack vectors.

Lastly, NoName057(16) was Telegram's most active hacker group, claiming 1459 DDoS attacks, followed by Anonymous Sudan with 660 attacks, and Team Insane PK with 588 attacks.

"Hacktivists are a major contributor to the dramatic increase in the volume and intensity of layer 7 attacks, and organisations across the globe are getting caught in the crosshairs," continues Geenens. 

"The effectiveness of these attacks has been significantly amplified as hacktivists rally patriotic volunteers and provide them access to crowd-sourced botnets, custom attack tools, and detailed attack tutorials."

According to attacks claimed by hacktivists on Telegram, politically motivated and religious groups waged multiple DDoS campaigns during the first half of 2023.

Most of the hacktivists claimed DDoS attacks targeted India (674 attacks), followed by the United States (507 attacks), Israel (459 attacks), Ukraine (376 attacks), and Poland (297 attacks).

Regarding website targets, Government (1112 attacks), business/economy (1036 attacks), and travel (628 attacks) faced the most hacktivist attacks, followed by financial services (420 attacks) and health/medicine (329 attacks).

Various regions across the globe emerged as DDoS hot spots. According to Radware's attack activity during the first half of 2023, EMEA shouldered the largest number of DDoS attacks, blocking 66% of the attacks and facing 48% of the attack volume.

The Americas blocked 25% of the DDoS attacks. While the Americas blocked a smaller share of attacks than EMEA, the Americas experienced a threat level on par with EMEA, bearing nearly equal attack volumes (47%).

Furthermore, the APAC region blocked 9% of the DDoS events and faced 5% of the global attack volume.

Radware's global attack activity revealed that research and education bore almost a third (32%) of the DDoS attack volume, while service providers and technology accounted for 20% and 12%, respectively. However, the distribution of DDoS attack volume varied on a regional basis.

During the first half of 2023, In the Americas, service providers (39%) and research and education (38%) drew the majority of the DDoS attack volume, followed by healthcare (7%) and energy (6%).

In EMEA, technology (32%) experienced the most significant share of the DDoS attack volume, followed by gaming (15%) and telecom (15%).

Lastly, In APAC, service providers (50%) bore the brunt of the DDoS attack volume, followed by retail (21%), gaming (9%), and transportation and logistics (6%).

While there was near-linear growth in the number of web transactions per quarter in 2022, there was exponential growth in the first half of 2023.

According to Radware, malicious web application transactions grew by 500% compared to the first half of 2022. The sharp rise underscores the significant shift in DDoS attack patterns as attacks increasingly progress to layer 7.

The most significant security violation was predictable resource location attacks (34%), followed by SQL (20%) and code injection attacks (10%), together generating 64% of total web application attack activity.

Moreover, the most attacked industry was retail (36%), followed by carriers (11%) and SAAS providers (8%).