For almost three months, Internet-of-things botnets built by software called Mirai have been a driving force behind a new breed of attacks so powerful they threaten the Internet as we know it. Now, a new botnet is emerging that could soon magnify or even rival that threat.
The as-yet unnamed botnet was first detected on November 23, the day before the US Thanksgiving holiday. For exactly 8.5 hours, it delivered a non-stop stream of junk traffic to undisclosed targets, according to this post published Friday by content delivery network CloudFlare. Every day for the next six days at roughly the same time, the same network pumped out an almost identical barrage, which is aimed at a small number of targets mostly on the US West Coast. More recently, the attacks have run for 24 hours at a time.
While the new distributed denial-of-service attacks aren't as powerful as some of the record-setting ones that Mirai participated in, they remain plenty big, especially for an upstart botnet. Peak volumes have reached 400 gigabits per second and 200 million packets per second. The attacks zero in on layer 3 and layer 4 of a target's network layer and are aimed at exhausting transmission control protocol resources.
While 400Gbps is less than half the bandwidth volume some targets have recently reported receiving, it's still enough firepower to knock any site offline unless it invests what can often be non-trivial amounts of money for protection for DDoS-mitigation services such as CloudFlare. What's more, in many of the recent attacks, Mirai-based botnets weren't the sole ones participating. If the new botnet continues to grow or its resources are augmented with other botnet strains, it's possible the combined strength could soon match or surpass the recent record-setting volumes.
Reply With Quote
Bookmarks