Loading story…
Akamai reported the first observed in-the-wild DDoS attacks using TCP Middlebox Reflection, a technique that abuses vulnerable firewalls, deep packet inspection devices, content-filtering systems, and censorship-related middleboxes to reflect and amplify traffic toward victims. The activity marked the practical weaponization of an attack path that had previously been discussed largely as a theoretical risk, with campaigns beginning around February 17 and hitting organizations in banking, travel, gaming, media, and web hosting.
In one case, a single TCP SYN packet with a 33-byte payload triggered a 2,156-byte response, producing roughly 65x amplification and lowering the bandwidth attackers need for volumetric attacks. Akamai observed attack traffic peaking at 11 Gbps and 1.5 million packets per second, underscoring that amplification threats are no longer limited to the better-known UDP-based reflection methods tracked by defenders and government agencies, and that mitigation strategies must now account for abuse of TCP-handling middleboxes as well.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
An academic study published in August 2021 described a TCP-based reflected denial-of-service amplification vector that abuses protocol-noncompliant middleboxes. This established the technique before it was later observed in real-world attacks.
Akamai reported the first observed real-world DDoS attacks using TCP Middlebox Reflection, marking the shift of the technique from theory to practice. In observed campaigns, traffic peaked at 11 Gbps and 1.5 million packets per second, and one case showed a 33-byte SYN packet triggering a 2,156-byte response for roughly 65x amplification.
Akamai said the first noticeable in-the-wild campaigns using TCP Middlebox Reflection began around February 17. The attacks targeted customers in banking, travel, gaming, media, and web hosting, and were observed both as standalone and multi-vector DDoS activity.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceakamai.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A major user-generated content platform was hit by a highly distributed **low-and-slow DDoS campaign** that generated **2.45 billion malicious requests in five hours**, peaking at **205,344 requests per second** and averaging about **136,000 requests per second**. According to DataDome’s Galileo threat research team, the operation relied on more than **1.2 million unique IP addresses** spread across **16,402 ASNs**, with no single network contributing more than 3% of the traffic. The attackers used a pulsed cadence and kept per-IP activity low—roughly one request every nine seconds on average—to stay below conventional rate-limiting thresholds and make simple IP blocking ineffective. The traffic was designed to resemble legitimate users by rotating IPs, user agents, and payloads and by forging HTTP headers, cookies, and TLS fingerprints. Researchers said the botnet also blended traffic through anonymization-friendly providers and major cloud infrastructure including **Cloudflare, AWS, and Google**, complicating filtering efforts. DataDome reported that it detected and blocked the attack in real time using **behavioral analysis**, server-side fingerprinting, and threat intelligence, finding inconsistencies between claimed browser identities and actual TLS handshake behavior. The incident underscores how modern DDoS operators are shifting from brute-force floods to distributed evasion techniques that require time-based behavioral detection rather than static volume limits.
Jun 29, 2026
Cloudflare reported mitigating a **record-setting hyper-volumetric DDoS attack** attributed to the **AISURU/Kimwolf** botnet that peaked at **31.4 Tbps** and lasted **35 seconds** in **November 2025**. The activity was described as part of a broader late-2025 surge in hyper-volumetric HTTP DDoS events that Cloudflare said were automatically detected and blocked, with **Q4 2025** hyper-volumetric attacks increasing **40%** quarter-over-quarter and the largest attacks growing **700%** compared to late 2024. Reporting tied AISURU/Kimwolf to DDoS-for-hire style operations and additional campaigns such as **“The Night Before Christmas”** (starting **December 19, 2025**), with Cloudflare citing campaign averages around **3 Bpps**, **4 Tbps**, and **54 Mrps**, and peaks up to **9 Bpps**, **24 Tbps**, and **205 Mrps**. The botnet’s capabilities and impact extend beyond web-layer floods: it has been associated with UDP/TCP/GRE flooding techniques and disruption of broadband providers via traffic sourced from compromised customer devices/CPE, and it has been described as enabling other illicit activity (e.g., credential stuffing, scraping, spam, phishing); separate reporting also stated the botnet has leveraged a large pool of compromised devices, including **millions of Android-based endpoints** such as off-brand Android TVs.
Jun 29, 2026
A March multinational operation involving the United States, Canada, and Germany disrupted infrastructure supporting the Aisiru and Kimwolf botnets, contributing to a fall in the largest observed botnet from 13.5 million devices in Q1 2026 to 2.09 million in Q2. Link11 also reported a 42% decline in DDoS attacks in Europe during the first half of 2026, partly attributing the reduction to law-enforcement actions including Operation Eastwood and the shutdown of four IoT botnets. Attackers are compensating with more powerful and resilient campaigns: Link11 recorded peaks of **2.3 Tbit/s** and **322 million packets per second**, with 705 TB of cumulative malicious traffic, driven by super-botnets and hijacked cloud servers. Operators are increasingly dispersing traffic sources and adopting decentralized command infrastructure; the Aeternum and Void botnets use Polygon and Ethereum smart contracts for C2 distribution. DDoS surges are also being used to conceal SQL-injection and XSS probing, requiring defenses that combine continuous traffic inspection, behavioral detection, adaptive filtering, and application-layer monitoring.
Sep 4, 2026