DDoS Attack Trends in 2024 Signify That Sophistication Overshadows Size

If there was one common theme among almost all DDoS attacks observed by Akamai’s DDoS protection solutions, including Akamai Prolexic, Akamai Edge DNS, and Akamai App & API Protector, is that cybercriminals were consistent in targeting multiple IP addresses and internet-facing assets and services with a variety of DDoS attack types. These assets and services include HTTP, DNS, IPSEC, SD-WAN, security information and event management (SIEM) web front ends, FTPS services, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), SYN floods, and others.

These “horizontal DDoS attacks”  have become fairly common with the wide availability of AI tools that can cast a wide net, systematically check for defense vulnerabilities, identify weak points, and then pool resources to go after the weakest points in an organization’s defense posture.

Figure 1 shows the wide prevalence of horizontal DDoS attacks. Almost 30% of the total DDoS attacks mitigated by Akamai Prolexic were multidestination, horizontal DDoS attacks. It is important to note that until as recently as Q3 2022, horizontal DDoS attacks accounted for fewer than 20% of the total DDoS attacks.

However, since Q4 2022, these types of attacks have accounted for up to 30% of the total DDoS attacks mitigated by Akamai.

Do you remember the name of the movie that won the Academy Award for Best Picture in 2023? If not, here’s a reminder: Everything Everywhere All at Once. You could be forgiven for believing that cybercriminals took this movie title as an inspiration for their attacks in 2024 … and beyond.

Almost all the DDoS attacks mitigated by Akamai in 2024 were highly sophisticated attacks that employed multiple attack vectors, used either simultaneously or in a rapidly evolving cycle to overwhelm DDoS defense platforms that depend on automation only. Modern attacks — on multiple destinations, multiple vectors, and multiple layers of a network (Layers 3, 4, 5, 6, and 7, including HTTP and DNS) per the Open Systems Interconnection (OSI) model, and with rapidly evolving TTPs — can truly be summarized as everything everywhere all at once.”

Figure 2 showcases the increasing variety of DDoS attack vectors employed by cybercriminals and threat actors to overwhelm automation-only DDoS defense platforms. The increasing number of DDoS attack vectors and the rapidly cycled manner in which they are used for amplifying an attack’s impact attests to the pivot of cybercriminals from volume to sophistication.

It’s not just that the modern DDoS attacks are multidestination and multi-vector. They are also getting longer in duration, often running as well-orchestrated DDoS campaigns for several hours, or even days and weeks, at a time.

There are two key underlying factors that support this trend. 

1. Multiple geopolitical conflicts around the world have enabled threat actors with the financial and technical resources necessary to launch and sustain massive, long-duration DDoS attack campaigns on their enemies. 

2. The other factor is that the wide proliferation of AI-enabled systems and infected Internet of Things devices that turn into bots are extremely useful to the threat actors. As the new generation of technologies rapidly evolves, it has become a game of one-upmanship between the criminals and security systems.

DDoS attacks that last longer than 60 minutes often systematically test weaker points in a network’s defense systems before pooling resources to overwhelm the bandwidth of the network and impact connectivity.

Figure 3 showcases that while the average duration of DDoS attacks has remained flat over the past three years, the number of highly sophisticated and orchestrated attacks that last 60 minutes or more have continued to increase.

We’ve said it before and we’ll say this again: If your DNS goes down, your online presence disappears. It is therefore not surprising that threat actors are doubling down on attacking the DNS infrastructure of vulnerable organizations.

What makes DNS a particularly easy target is that unlike modern network infrastructures, DNS was developed in the early days of the internet when security wasn’t a major concern. Back then, the focus was on the speed and convenience of using human language to interact with digital assets.

Over the decades, many organizations that invested capital in developing on-prem DNS infrastructure have been left vulnerable to DNS DDoS attacks.

Figure 4 shows more than 60% of the total DDoS attacks mitigated by Akamai in Q1, Q3, and Q4 2024 had a DNS component. It is interesting to note that while DNS resource exhaustion (or Layer 7 DNS query flood) attacks were the leading type of DNS-focused attacks in 2023, threat actors have pivoted back to DNS reflection as a preferred vector of DNS attacks since Q2 of 2024. Additionally, in some instances, infrastructure that hosts DNS and DNS-related services could be underprovisioned or inadequately protected from the evolving threats. These changes emphasize the need for robust DNS DDoS defense systems that can easily adapt to evolving threat variables.

Although the impact of the sophistication and complexity of modern DDoS attacks outweighs the impact of their size, it is also important to acknowledge that threat actors are employing all the TTPs available to them to orchestrate debilitating DDoS attacks.

And one potent variable is, in fact, size — which, when combined with multiple vectors and multiple destinations all at once, makes it easy to overwhelm and bring down DDoS defense platforms that aren’t equipped to handle the onslaught of such attacks.

Four of the 10 largest DDoS attacks ever mitigated by Akamai Prolexic took place in 2024. The proliferation of AI-powered tools and global botnets have made it relatively easy and inexpensive for attackers to scale up the size of DDoS attacks.. 

Let’s state the obvious: Web applications and APIs run the world today. You are probably reading this blog post using a web browser — that is, an application — on your computer or phone. Or maybe you saw a post about this blog on the LinkedIn app on your smartphone or tablet. When internet-facing applications drive the modern world, it is not surprising that cybercriminals often tend to focus their DDoS attacks on the applications of a victim organization.

In 2024, Akamai observed a continuing trend of massive Layer 7 attacks, or application-layer attacks, primarily in North America and the Europe, Middle East, and Africa region. Figure 6 shows an increase in application-layer attack traffic in the final months of the year. There was a noticeable spike in Layer 7 DDoS attacks in the Asia-Pacific region during the final quarter of the year, often targeting financial services organizations and critical infrastructure for public services.

1. Prepare your defenses proactively. Reduce the attack surface of your network and build robust runbooks that can save precious seconds during an inevitable DDoS attack. 

2. Appreciate the fact that modern sophisticated DDoS attacks are no longer just about volume. Today’s DDoS defenses require advanced machine-level automation along with invaluable human expertise and tight processes to be effective. Automation alone could lead to overmitigation and block genuine user traffic. It could also be easily and accidentally misconfigured with unintended consequences. Use automation wisely, tactically, and safely with the consultation of trained professionals.

3. Recognize that in a digital-first world, going offline — even for a second — or unintentionally blocking some percentage of legitimate users to give the perception of uptime are unacceptable outcomes. Trust your security to solutions that have withstood the test of time. DDoS defense platforms that go offline themselves cannot protect your network during times of need. Choose wisely, or you might end up spending many hours (and dollars!) trying to restore your network after a DDoS attack.