- Cloudflare says it blocked a 5.6 Tbps DDoS attack in October 2024
- The attack came from a Mirai botnet
- It included 13,000 IPs and lasted 80 seconds
Cloudflare has claimed that it recently blocked the largest DDoS (Distributed Denial of Service) attack ever recorded.
In a blog post, the company said that in late October 2024, its defense mechanisms blocked a 5.6 Tbps UDP (User Datagram Protocol) DDoS attack. To put things into perspective, the (now) second largest DDoS attack ever was 3.8 Tbps, also blocked by Cloudflare, also in October 2024.
The company said the attack was launched by a Mirai variant botnet and targeted an internet service provider (ISP) from East Asia.
Shorter, but more violent
The attack lasted just over a minute (80 seconds) and involved more than 13,000 Internet-of-things (IoT) devices, it said.
As attackers change their strategies to better adapt to an evolving DDoS threat landscape, attacks have generally become shorter in duration, but more intense and frequent.
Despite its destructive potential, the attack did no harm, Cloudflare said, as both detection and mitigation were completely autonomous.
“It required no human intervention, did not trigger any warnings, and did not cause any performance degradation,” Cloudflare said. “The systems worked as intended.”
The researchers also emphasized that while the total number of unique source IP addresses was around 13,000, the average unique source IP addresses per second 5,500. Each of the 13,000 IP addresses contributed less than 8 Gbps per second, while the average contribution for each IP address per per second was around 1 Gbps (~0.012% of 5.6 Tbps).
Mirai is one of the most notorious botnets out there. Its source code leaked in 2017, after which various threat actors began building their own variants. Today, Mirai and its variants often make headlines, targeting various organizations with large-scale DDoS attacks. This week, security researchers observed two variants, ‘gayfemboy’ and ‘Murdoc Botnet’.
