The longest continuous attack recorded by Kaspersky Lab lasted almost two weeks

The longest continuous attack recorded by Kaspersky Lab in the third quarter of 2015 lasted for 320 hours, or almost two weeks. This is one of the findings of the new quarterly DDoS report, based on constant monitoring of botnets and observing new techniques utilised by cybercriminals.

The Q3 report shows that DDoS attacks remain highly localised. 91.6% of victims’ resources are located in only 10 countries around the world, although we have recorded DDoS attacks targeting servers in 79 countries total. What is even more significant is that DDoS attacks are most likely to originate from the same countries.The longest continuous attack recorded by Kaspersky Lab in the third quarter of 2015 lasted for 320 hours, or almost two weeks. This is one of the findings of the new quarterly DDoS report, based on constant monitoring of botnets and observing new techniques utilised by cybercriminals.

The Q3 report shows that DDoS attacks remain highly localised. 91.6% of victims’ resources are located in only 10 countries around the world, although we have recorded DDoS attacks targeting servers in 79 countries total. What is even more significant is that DDoS attacks are most likely to originate from the same countries.

China, the United States of America and South Korea occupied top positions in both ratings of the most frequent attack sources and targets. Although other cybercrime syndicates, focusing on things like credit card theft, may operate far from their country of residence, this is not the case for DDoS.

More than 90% of attacks lasted less than 24 hours but the number of attacks lasting over 150 hours grows significantly. The highest number of attacks on the same victim was 22, on a server located in The Netherlands.

The report also showed that Linux-based botnets are significant, accounting for up to 45.6% of all attacks recorded by Kaspersky Lab. Main reasons include poor protection and higher bandwidth capacity.

“Based on our observations and direct measurements, we cannot pinpoint one exact direction in which the underground business of DDoS attacks is moving," commented Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab.

"Instead, the threat appears to be growing everywhere. We have recorded highly complex attacks on banks, demanding a ransom, but have also observed new, low-cost methods designed to put a company’s operations down for a significant amount of time. Attacks are growing in volume with most of them aiming to attack, disrupt and disappear, but the number of lengthy attacks, capable of bankrupting a large, unprotected business is also on the rise. These significant developments make it imperative for companies to take measures to prevent the very real threat and increased risk posed by DDoS attacks.”

The study also found that cybercriminals go on vacation too, just like regular people, with August the quietest month of the quarter for attacks. Meanwhile, banks are frequent targets of complex attacks and ransom demands.

China, the United States of America and South Korea occupied top positions in both ratings of the most frequent attack sources and targets. Although other cybercrime syndicates, focusing on things like credit card theft, may operate far from their country of residence, this is not the case for DDoS.

More than 90% of attacks lasted less than 24 hours but the number of attacks lasting over 150 hours grows significantly. The highest number of attacks on the same victim was 22, on a server located in The Netherlands.

The report also showed that Linux-based botnets are significant, accounting for up to 45.6% of all attacks recorded by Kaspersky Lab. Main reasons include poor protection and higher bandwidth capacity.

“Based on our observations and direct measurements, we cannot pinpoint one exact direction in which the underground business of DDoS attacks is moving," commented Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab.

"Instead, the threat appears to be growing everywhere. We have recorded highly complex attacks on banks, demanding a ransom, but have also observed new, low-cost methods designed to put a company’s operations down for a significant amount of time. Attacks are growing in volume with most of them aiming to attack, disrupt and disappear, but the number of lengthy attacks, capable of bankrupting a large, unprotected business is also on the rise. These significant developments make it imperative for companies to take measures to prevent the very real threat and increased risk posed by DDoS attacks.”

The study also found that cybercriminals go on vacation too, just like regular people, with August the quietest month of the quarter for attacks. Meanwhile, banks are frequent targets of complex attacks and ransom demands.