Скачать или смотреть Record 840 Million PPS DDoS Attack Targets OVHcloud via Compromised MikroTik Routers

In April 2024, French cloud computing company OVHcloud successfully mitigated a record-breaking distributed denial-of-service (DDoS) attack, which peaked at an unprecedented 840 million packets per second (Mpps). This attack surpassed the previous record of 809 million Mpps, which targeted a large European bank in June 2020. The April attack combined a TCP ACK flood from 5,000 source IPs and a DNS reflection attack using approximately 15,000 DNS servers. Despite being globally distributed, two-thirds of the total packets came from four points of presence in the U.S., three of which were on the west coast. OVHcloud highlighted the adversary's ability to generate massive packet rates through a few peerings, posing a significant challenge.

OVHcloud reported a significant rise in the frequency and intensity of DDoS attacks since 2023, with incidents exceeding 1 terabit per second (Tbps) becoming common. According to Sebastien Meriot from OVHcloud, attacks surpassing 1 Tbps have evolved from being rare to almost daily occurrences, with the highest bit rate observed reaching around 2.5 Tbps. Unlike typical DDoS attacks that flood targets with junk traffic to exhaust bandwidth, packet rate attacks overwhelm the packet processing engines of networking devices, such as load balancers, near the destination. OVHcloud's data shows a sharp increase in DDoS attacks with packet rates over 100 Mpps, many of which stem from compromised MikroTik Cloud Core Router (CCR) devices. These routers, running outdated software with known vulnerabilities, expose an administrative interface that attackers exploit, likely utilizing the operating system’s Bandwidth test feature for the attacks.