The geography of DDoS attacks is expanding, and their number is growing

The volume of DDoS attacks for the first quarter in Russia increased by more than 50% compared to last year. The geography of attacks has expanded, and although they themselves have become less likely to lead to unacceptable events for companies, the low costs of hackers allow them to continue to use the tactics of “carpet bombing” a wide range of companies and institutions.

The number of DDoS attacks (attacks on a server using the “denial of service” model) in Russia in the first quarter of 2023 increased by 58%, from 226.1 thousand in the same period last year to 384.8 thousand, calculated in the vendor DDoS-Guard cybersecurity solutions. The upward trend in attacks is confirmed by Qrator Labs, according to this company, the intensity peaked in February, when the number of IP addresses involved in attacks exceeded 12 million.

MTS Red analysts, for their part, estimated that in April compared to March of this year, the increase in the number of DDoS attacks was 81%, and for incomplete May – 69%.

MTS also sees that the geography of attacks has become more diverse. If a year ago, the absolute majority of strikes fell on the Central Federal District, then in the first quarter of 2023, the leader in the number of attacks was the North-West, and the leading city was St. Petersburg: 87% of all DDoS attacks were implemented on organizations located here, told in MTS Red. The second place was taken by the Central Federal District (Tver — 11.7% of attacks). The Volga Federal District closes the top three (Ulyanovsk — 0.5% of attacks). In addition, the distribution area of ​​DDoS attacks in the first quarter included Khabarovsk, Chelyabinsk, Surgut, Tyumen, Novosibirsk, and Stavropol.

Recently, DDoS attacks have become less likely to lead to unacceptable events, MTS Red notes. One of the latest large-scale cyberattacks was an unsuccessful attempt on May 22 to disable the United Russia portal “Preliminary Voting”. The resource is intended for the selection of candidates and their subsequent nomination from the party to the deputies of legislative bodies as part of the single voting day in 2023.

However, the hackers have clearly switched to the tactics of massive attacks in the expectation that at some point some of the tens of thousands of attempts will be successful.

The frequency, intensity and level of organization of DDoS attacks are constantly growing, says Andrey Dugin, head of the MTS Red cybersecurity services center. The average cost of organizing a simple cyber attack is about 900 rubles. in a day. At the same time, “hackers are trying to bypass the filtering mechanisms,” notes Danila Chezhin, Product Director at Servicepipe. Since the beginning of the year, cyberthreat researchers have noted an expansion in the range of attack targets for intruders, attributing this to the improvement in the quality of network monitoring by hackers (see “Kommersant” dated April 25).

Legal consequences if a hacker is caught and convicted under Art. 273 of the Criminal Code of the Russian Federation (creation, use and distribution of malicious computer programs) varies from a fine to seven years in prison, depending on the actions of the accused as part of an organized group and the amount of damage caused. But, as Sergei Polunin, head of the infrastructure IT defense group at Gazinformservice, notes, “in fact, harsh sentences under this article are very rare.”

Tatiana Isakova, Yulia Poslavskaya