<img alt="" height="630" loading="lazy" src="https://content2.stormwall.pro/or/images/company-news/picture-post-52eng.jpg" width="1200" />

StormWall&rsquo;s DDoS Year-in-Review report takes a look at the 2022 threat landscape, breaks down the industries that were most affected, and explores current DDoS trends.

DDoS-attacks report for 2022 | StormWall

17 march 2023

<h1>2022: DDoS Year-in-Review Report by StormWall</h1>

StormWall&rsquo;s DDoS Year-in-Review report takes a look at the 2022 threat landscape, breaks down the industries that were most affected, and explores current DDoS trends.

<h2>DDoS attacks have evolved in 2022</h2>

Once more, 2022 became in many ways a record-breaker. As the criminals worked to build <a href="https://stormwall.network/blog-analytics-evolution-of-botnets">better botnets</a>, multi-terabit per second attacks steadily increased in frequency.

While the maximum attack power hovered around 1 Terabit per second (Tbit/s) in 2021, this year it almost doubled: attacks reaching 2 Tbit/s&nbsp; became dangerously common in 2022.

Similarly, there was a steady increase in the duration of attacks throughout the year. By the end of 2021, most companies had to deal with incidents that lasted up to 3 days.

All this became possible thanks to the emergence of new sophisticated botnets. Originally developed by hacktivists for politically motivated actions, their use eventually spilled over to common criminals.

The beginning of the year was marked by a sharp spike in hacker and hacktivist DDoS activity in the first quarter. The trend carried over into the second quarter and then <a href="https://stormwall.network/blog-ddos-attacks-report-for-q3-2022">into the third</a>. But the momentum blunted in the fourth quarter as hacktivist activity subsided.

<img alt="" height="630" loading="lazy" src="https://content2.stormwall.pro/or/images/company-news/picture-post-52eng.jpg" width="1200" />

<h2>Global DDoS attack trends in 2022</h2>

<ul>
	<li>Overall, there was a 74% YoY increase in the number of DDoS attacks <a href="https://www.infosecurity-magazine.com/blogs/ddos-attacks-in-2022-trends/">in 2022</a>.</li>
	<li>But the momentum took a turn in the fourth quarter. From the end of October, the growth rate began to slow down. The decline continued in November. And in December, the number of attacks plummeted by as much as 53% compared to the previous month.</li>
	<li>The year was marked by a dramatic increase in the power of botnets, which drove stronger and more sustained attacks.</li>
	<li>Criminals targeted the fintech industry more than others. It suffered 34% of the incidents. There&rsquo;s also been a 12-fold increase of attacks on financial services.</li>
	<li>Hacktivists contributed to the increase in the strength and duration of attacks, developing tools for politically motivated actions that were eventually adopted by for-profit criminals.</li>
</ul>

<h2>DDoS attack statistics by industry</h2>

Here&rsquo;s which industries were most affected by DDoS:

<ul>
	<li>Finance: 34%</li>
	<li>Telecommunications: 26%</li>
	<li>Retail:&nbsp; 17%</li>
	<li>Entertainment: 12%</li>
	<li>Insurance: 6%</li>
	<li>Education: 2%</li>
	<li>Logistics: 2%</li>
	<li>Others: 1%</li>
</ul>

<img alt="" height="550" loading="lazy" src="https://content2.stormwall.pro/or/images/company-news/pie_cart1_en.png" width="1200" />

Figure 1. DDoS attack statistics by industry in 2022. Source: StormWall

<h3>Finance</h3>

In 2022, the main DDoS blow fell on the financial industry, with almost a third of all attacks (34%) targeting this vertical. This sector also saw the sharpest growth, with attacks up 12 times year-over-year.

The fintech industry has <a href="https://cyberprotection-magazine.com/ddos-attack-wave-on-banks-how-can-companies-protect-themselves">traditionally</a> been a DDoS hotspot. Threat actors often conduct powerful attacks on online financial services in an effort to disrupt payment processing. This is done as an extortion tactic or as a <a href="https://www.cybersecasia.net/newsletter/ddos-attacks-may-be-a-smokescreen-for-other-concurrent-cyber-activity">smokescreen</a> to cover up a simultaneous malware or ransomware hack. But in 2022, a lot of incidents were initiated by hacktivists, especially in the first two quarters of the year. Though, their activity blunted towards the fourth quarter.

Attacks lasted an average of 8 hours, and the maximum power seen by StormWall reached 1 million requests per second. Such attacks are only possible using sophisticated botnets. This is one instance when tools, originally designed by hacktivists for their own use, are now beginning to see wider adoption, shaping the overall threat landscape.

<h3>Telecommunications</h3>

The telecommunications industry became a close-second in terms of attack numbers (26%). Attacks <a href="https://www.techradar.com/news/ddos-is-fast-becoming-a-potent-weapon-for-cybercriminals">increased</a> by 4 fold YoY.

As the pandemic forced many companies into remote working, video-conferencing became an indispensable driver of mission-critical business processes. Both politically motivated actors and for-profit hackers recognized the opportunity and began targeting businesses in this sector heavily. Attack goals ranged from hacktivism to extortion.

The peak attack power here reached 1,2 Tbit/s. The average duration was 8 hours. Many telecommunications companies have never faced a DDoS threat of this magnitude before. Unprepared, the attacks disrupted their services slightly, but most companies remained relatively <a href="https://stormwall.network/success-stories-africell">unscathed</a>, avoiding major outages.

Most attacks on the industry can be attributed to companies trying to bring down the competition using DDoS. Also, hacktivists, who are constantly looking for new targets, began to hit businesses in this vertical.

<h3>Retail</h3>

The e-commerce industry accounted for 17% of DDoS attacks in 2022. And there was a 53% YoY increase in the number of attacks on online stores. 

Most incidents were driven by unfair competition: companies <a href="https://stormwall.network/blog-edu-who-launches-ddos-attacks">launching</a> attacks on peers to shut down competing stores and increase their market share.

As usual, the attacks peaked during the holidays, when shoppers rushed to online stores for gifts and discounts. There was a sharp spike in February the week before Valentine&#39;s Day (up 38% from the previous week) and in November, particularly around Black Friday and Cyber Monday.

The trend towards increased use of botnets continues here, as some of the attacks have been uncommonly powerful. And the average duration of attacks hovered around 3 hours.

This data paints a worrying picture. While e-commerce store owners had historically used DDoS for unfair competition, they didn&rsquo;t usually employ botnets. These tools required a certain technical know-how, and were expensive to run. But this is all changing now, as botnet attacks are getting easier to launch and cheaper to maintain over long hauls. Thus, it is likely that such attacks will not only continue into 2023, but will also grow in destructive power and duration.

<h3>Entertainment</h3>

The entertainment industry suffered 12% of all DDoS attacks in 2022. And the number of incidents increased 3 fold YoY.

As quarantine measures are being lifted across countries, users spend less time consuming online content. This somewhat downplays the ability of hackers to use downtime as leverage for extortion. Because of this, the share of attacks on the entertainment industry decreased by 12% from the previous year, and bad actors have shifted their attention onto other industries.

But the overall number of attacks is growing across all industries, which explains the 5-fold increase in the total number of incidents.

<h3>Insurance</h3>

Around 6% of DDoS attacks in 2022 targeted businesses in the insurance sector, constituting a 5 fold YoY increase.

Adversaries often seek opportunities to extort money from insurance companies. Likewise, business competitors may use malicious methods to gain a foothold in the market. DDoS attacks are particularly devastating for firms in this sector &mdash; they can incur substantial financial losses, customer attrition, and serious damage to the company&#39;s reputation. After all, an assured level of service availability is paramount for insurers.

<h3>Education</h3>

In 2022, the education industry accounted for 2% of DDoS attacks. Their number increased by 36% compared to the previous year.

Reliance on online learning has been growing rapidly since the pandemic. In fact, about 77% of public college students are now taking at least one course online. But the networks that accommodate this aren&#39;t sufficiently hardened. And DDoS attacks are so easy to launch now, that even students can do it. Indeed, some of the attacks recorded this year were launched by students who targeted their academy networks during exams.

But many incidents were also driven by hacktivists trying to disrupt college admissions campaigns in Russia: the first quarter of 2022 saw a sharp surge in attacks targeting the country&rsquo;s universities.

Several websites that lacked professional DDoS protection experienced a prolonged outage. Many critical services were shut down, making it impossible for students to apply for admission. Such academies had to frantically connect DDoS protection to restore networks to working order.

<h3>Logistics</h3>

The logistics vertical accounted for a 2% share of DDoS attacks in 2022. And a 64% YoY increase in attack frequency was observed.

Digital enterprise supply chains rely on interconnected components: like links in a chain. Many are maintained by outside vendors, and the client essentially has to trust in their ability to secure these systems. But some vendors still use open source software, and some have relaxed their security measures in the post-pandemic world of remote work. This creates a huge vulnerability and leaves otherwise resilient companies vulnerable to attacks.

Supply chains are only as strong as their weakest link, so shattering one can bring the whole thing down. Of course, hackers quickly seized the opportunity, distracting cybersecurity teams with DDoS while staging backdoor attacks. This can result in breaches and leaks of confidential data.

But for-profit criminals weren&rsquo;t the only source of danger this year. Hacktivists also launched a series of large-scale DDoS offensives against logistics businesses in Russia, in an attempt to disable critical supply chains.

<h2>DDoS attacks by protocols</h2>

<ul>
	<li>HTTP/HTTPS 78%</li>
	<li>TCP/UDP 17%</li>
	<li>DNS 2%</li>
	<li>Others 3%</li>
</ul>

<img alt="" height="490" loading="lazy" src="https://content2.stormwall.network/or/images/company-news/pie_cart2_en.png" width="1200" />

<cite>Figure 2. Dynamics of protocol attacks in 2022. Source: StormWall</cite>
<dp>The vast majority of DDoS attacks in 2022 (78%) were directed at the application layer of the <a href="https://en.wikipedia.org/wiki/OSI_model">OSI model</a>. Only 17% of attacks hit the network and transport layers, and even fewer attack the <a href="https://stormwall.network/knowledge-base/protocol/dns">DNS</a> (3%).

Interestingly, the distribution of attacks by protocol is reversed compared to last year. In the third quarter of 2021, more than 80% of attacks were packet flooding, targeting the transport and application layers. Maintaining <a href="https://stormwall.network/knowledge-base/protocol/http">HTTP</a> floods capable of constantly overloading enterprise networks was simply too expensive. This year, everything has changed, as the cost of using sophisticated botnets has decreased while their firepower, on the contrary, has increased manifold.

This has forced businesses into a race to rethink DDoS protection, as the security measures implemented to increase their resilience against TCP/<a href="https://stormwall.network/knowledge-base/attack/udp-flood">UDP</a> floods are now insufficient.

<h2>DDoS attacks by country</h2>

<ul>
	<li>USA: 18,3%</li>
	<li>China: 10,7%</li>
	<li>India: 9,2%</li>
	<li>Russia: 8,4%</li>
	<li>England: 7,2%</li>
	<li>Germany: 6,8%</li>
	<li>France: 5,3%</li>
	<li>Japan: 4,7%</li>
	<li>Ukraine: 4,5%</li>
	<li>Brazil: 4,2%</li>
	<li>UAE: 3,8%</li>
	<li>Spain: 3,6%</li>
	<li>Italy: 2,8%</li>
	<li>Turkey: 2,3%</li>
	<li>Serbia: 1,7%</li>
	<li>Hungary: 1,4%</li>
	<li>Others: 5,1%</li>
</ul>

<img alt="" height="755" loading="lazy" src="https://content2.stormwall.network/or/images/company-news/pie_cart_3_en.png" width="1200" />

Figure 3. DDoS attack statistics by country in 2022. Source: StormWall

The US was struck by 18.3% of all DDoS attacks, bearing the heaviest blow. Like elsewhere in the world, the number of attacks peaked in the first and second quarters of the year. The trend then began reversing in the third quarter, and flipped downwards in the fourth. Threat actors were most active on Fridays, potentially hoping to catch security teams unawares at the week&rsquo;s end.

China, which was hit by 10,7% of attacks, was the second hottest DDoS hotspot this year. China is traditionally a major source of global DDoS traffic.

India was a close runner up for the undesirable 2nd place. It came in third, with 9.2% of incidents finding their targets in the republic. Some attacks can be attributed to hacktivism, but it wasn&rsquo;t the only driver. Some incidents were carried out for the purpose of extortion, or as part of multi-vector hacks.

Russia, the fourth most attacked region, got hit by 8,4% of DDoS attacks. Obviously, this is due to the Russia &mdash; Ukraine conflict, which understandably made the former the main target of hacktivism. All industries were affected, from education to finance, as independent and state-sponsored gangs put the country under a real barrage. They tried hard to cripple critical infrastructure, paralyze businesses and banking, and sabotage the economy as a whole.

A more trivial story took place in the UK, where 7,2% of DDoS attacks landed. As one of the most developed economies in the world, it is typically targeted by for-profit criminals, who are trying to hit the jackpot. 
Conclusion

This year, DDoS actors have advanced and pretty much doubled their firepower. Unfortunately, the same cannot be said for most organizations, whose resilience to DDoS is dwindling as attack duration and power grows faster than businesses get better at mitigation.

And the impact of these attacks cannot be overestimated. If successful, they can cause days of downtime, disrupt learning, restrict access to information, and even banking. The threat will only grow. That is why StormWall recommends all companies to work with a professional security partner to build up their DDoS resistance.

The report can be downloaded <a href="https://content2.stormwall.pro/or/files/ddos-repot-stormwall-2022.pdf">in PDF-format</a>.
</dp>

2022: DDoS Year-in-Review Report by StormWall

<img alt="" height="630" loading="lazy" src="https://content2.stormwall.pro/or/images/company-news/picture-post-50_eng.png" width="1200" />

StormWall is celebrating its 10th anniversary. For all these years we&rsquo;ve been on guard for our clients and have done a lot &mdash; let&#39;s recall the main achievements.

StormWall is celebrating its 10th anniversary. For all these years we’ve been on guard for our clients and have done a lot — let's recall the main achievements.

10 years of StormWall — DDoS protection results

12 march 2023

<h1 dir="ltr">10 years you choose StormWall DDoS protection</h1>

<img alt="" height="630" loading="lazy" src="https://content2.stormwall.pro/or/images/company-news/picture-post-50_eng.png" width="1200" />

StormWall is celebrating its 10th anniversary. For all these years we&rsquo;ve been on guard for our clients and have done a lot &mdash; let&#39;s recall the main achievements.

StormWall is one of the strongest players in the international DDoS protection market today. By 2023, the company has opened six scrubbing centers in Frankfurt am Main (Germany), Hong Kong (China), Washington (USA), Moscow (Russia), Almaty (Kazakhstan) and Singapore (Southeast Asia). This geographical coverage provides filtering capacity of up to 3.5 Tbit/s and allows us to provide customers from different parts of the world with minimal delay when passing traffic.

StormWall was founded 2013 &mdash; and from a team of two people it has grown into an international with 60 employees across seven different countries. The company has developed its own product with flexible settings for protection against DDoS attacks in real time and using artificial intelligence. StormWall Portal has an intuitive interface and many useful features.

StormWall today protects customers from DDoS attacks in 70 countries and strives to expand the geography of its presence: in 2021, StormWall services received recognition from major telecom operators in Africa and the Middle East.

Our company plans to keep pace in development of our solutions to make the most reliable and easy-to-use DDoS protection. We thank our clients and partners for your loyalty and support &mdash; you loving StormWall is the best reward we can ever have.

10 years you choose StormWall DDoS protection

<img alt="" height="630" loading="lazy" src="https://content2.stormwall.network/or/images/company-news/picture-post-47.png" width="1200" />

Transparent DDoS protection settings, more useful features and attention to detail - since the end of last year, StormWall has added a number of new features to the StormWall Portal. Let&#39;s take a closer look.

Transparent DDoS protection settings, more useful features and attention to detail - since the end of last year, StormWall has added a number of new features to the StormWall Portal. Let's take a closer look.

New StormWall Portal features — February, 2023 | StormWall

28 February 2023

<h1>New StormWall Portal features</h1>

Transparent DDoS protection settings, more useful features and attention to detail - since the end of last year, StormWall has added a number of new features to the StormWall Portal. Let&#39;s take a closer look.

<h2>DDoS protection for websites</h2>

<a href="https://stormwall.network/website-protection">DDoS protection for websites</a> is performed at all levels of the OSI model with full access to real-time analytics in the StormWall Portal. In this section you can set the security parameters applicable for their project.

<h2>Greylist</h2>

The ability to configure Greylists has been added to the existing standard White- and Black- lists in the StormWall Portal and through the API. The <a href="https://stormwall.network/knowledge-base/termin/ip-address">IP addresses</a> and networks included in this list can be checked by the following mechanisms: Redirect, JS validation or CAPTCHA.

<img alt="" height="890" loading="lazy" src="https://content2.stormwall.network/or/images/company-news/greylist_en.png" width="1147" />

Examples of the Greylists option use:

<ul>
	<li>suspicious IP addresses, if there are no serious reasons to block them;</li>
	<li>test the protection level without enabling protection for the whole website (for example, you can add tester&rsquo;s IP to Greylist without changing protection mode for the whole website).</li>
</ul>

<h2>Location Filters</h2>

A handy counter for specific locations of the (URL) <a href="https://stormwall.network/knowledge-base/termin/domain">domain</a>, allows you to determine the number of requests with specific methods for a specified period of time and perform a specific action when this limit is exceeded. Allows you to precisely set the allowed number of requests to specific site URLs.

This addition will help block bots even if they have full browser stack and can bypass other protection mechanisms. This means that, for example, if bots receive the 403 error a certain number of times they will be banned.

<img alt="" loading="lazy" src="https://content2.stormwall.network/or/images/company-news/location_filters_en.png" />

Examples of the Location Filters option use:

<ul>
	<li>protection against <a href="https://en.wikipedia.org/wiki/Brute-force_search">bruteforce</a> (hacking of accounts by guessing passwords);</li>
	<li>identifying requests from bots or people from anti-CAPTCHA services by specifying the maximum number of requests for a long period of time;</li>
	<li>blocking access to the website management system.</li>
</ul>

Additional functions of location filters:

<ul>
	<li><a href="https://apiv2.stormwall.network/swagger-public/">API support</a>, the ability to configure automation, filtering by content type, http methods;</li>
	<li>the subject of the calculation is the uid (a unique identifier assigned to the user by the system) and the IP address of the request initiator.</li>
</ul>

Actions that can be applied in location filters are banning the visitor or logging his requests.

<h2>HTTP Rule Chains</h2>

The new StormWall Portal feature*, previously available only in <a href="https://stormwall.network/waf">WAF</a> solutions, allows an entire constructor of rules to be created over the <a href="https://stormwall.network/knowledge-base/protocol/http">HTTP protocol</a> - with multi-level checks that take into account headers, locations, and the number of requests in a given time period.

HTTP Rule Chains work as follows: requests are passed through a chain of rules, where you can choose what actions are performed on the request, both when the conditions are met and when the conditions are not met: skip, block, or process in the next chain. With such a tree-like structure, you can create more <a href="https://stormwall.network/website-protection">reliable protection against bots</a>, parsers, and automation tools to bypass the protection.
<p*Please note that this feature is only available in the Enterprise plan.
<img alt="" loading="lazy" src="https://content2.stormwall.network/or/images/company-news/http_rule_chains_en.png" />

<h2>Protection of TCP/UDP and BGP network services: setting up black-/white lists</h2>

Edit the lists of allowed/prohibited IP addresses or networks: for example, add the IP addresses of partner systems, remote offices for VPN users from specific addresses to the protection exceptions.

<img alt="" loading="lazy" src="https://content2.stormwall.network/or/images/company-news/whitelist_rules_en.png" />

All new options listed in the StormWall Portal user can change (set up) on his own or with the help of technical support. It is possible to automate functions and work with the backend of applications and services using the <a href="https://stormwall.network/api-page">StormWall API</a>.

StormWall is constantly improving the DDoS filtering platform and developing the service towards detailed analytics and maximum manageability. Thus, we plan to increase the volume of network cleaning, add the ability to configure protection against other types of bots - and much more. Follow the updates on the official website and social networks.
</p

Protection from even the most severe DDoS attacks

Points of presence

Our advantages

Our clients

News

2022: DDoS Year-in-Review Report by StormWall

10 years you choose StormWall DDoS protection

New StormWall Portal features