Woburn, MA – October 31, 2016 – Kaspersky Lab has released a new report on botnet-assisted DDoS attacks for the third quarter of 2016, which is based on data received from Kaspersky DDoS Intelligence¹. Over the reporting period, research has shown that resources in 67 countries were targeted by botnet-assisted DDoS attacks. Activity by attack servers located in Western Europe and the number of resources attacked in the region have both increased considerably in the past quarter. The number of sophisticated DDoS attacks emanating from encrypted traffic has also grown.

This quarter saw three Western European entries – Italy, France and Germany – among the top 10 countries most affected by botnet DDoS attacks for the first time in a year. These statistics correlate with the growing number of active C&C (command and control) servers in Western Europe, particularly in the UK, France and the Netherlands. The number of attacks on resources located in Japan, the U.S. and Russia also increased, while the number of victims in China and South Korea fell considerably during the reporting period.

Despite a decrease in the total number of attacks registered in China, the most targeted resources were Chinese – the largest number of attacks (19) were launched against a popular Chinese search engine and a Chinese provider was subjected to the longest attack in the third quarter (184 hours). Meanwhile, the most active day for DDoS attacks registered over the last four quarters was August 3. There were 1,746 botnet attacks on that day, with many of them targeting the servers of a single service provider located in the U.S.

In the third quarter of 2016 the number of SYN-DDoS attacks continued to grow and accounted for 81 percent of all registered attacks, while the share of TCP-DDoS and ICMP-DDoS attacks fell once again. The percentage of attacks by Linux-based DDoS bots also continued to grow, reaching 79 percent – a record for the last year. This can be explained by the growing popularity of Linux-based IoT devices used for DDoS attacks.

Additionally, Kaspersky Lab experts also registered growth in the number of “smart” attacks using encryption of transmitted data. A typical example of such an attack is a relatively small number of queries being sent to the “load-heavy” parts of websites (such as search forms) via an encrypted connection. By residing in encrypted traffic and due to their low intensity, these attacks are very difficult for many specialized protection solutions to filter out.

“This method is growing in popularity because amplification attacks are becoming more complicated and inefficient for cybercriminals: the number of vulnerable servers is decreasing and security solutions have learnt to easily identify and filter out the majority of amplification attacks,” said Kirill Ilganaev, head of Kaspersky DDoS protection. “Secondly, the Internet is seeing a steady migration away from classic HTTP to encrypted interaction between users and web resources. All this suggests that the number of encryption-based attacks will only grow, meaning developers have to immediately start revising their anti-DDoS protection measures, and owners of web resources need to take a responsible approach to choosing a security solution.”

Kaspersky DDoS Protection combines Kaspersky Lab’s extensive expertise in combating cyber threats and the company’s unique in-house developments. The solution protects against all types of DDoS attacks regardless of their complexity, strength, or duration.