InfoSecBulletin Cybersecurity for mankind
A distributed denial-of-service attack hit a big user-content platform, sending an amazing 2.45 billion malicious requests in only 5 hours. Security company DataDome stopped the attack right away, so real users face no disruption. Experts looking into the event found that the attack used 1.2 million different IP addresses.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The attackers used a large network instead of just strong force methods. This move showed key weaknesses in regular security systems that mainly depend on fixed limits to find bad actions.
Massive DDoS Attack Generates 2.45 Billion Requests
The operation reached a peak of over two hundred thousand requests every second and had an average of about one hundred thirty-six thousand requests per second.
The attackers did not just attack all the time. Instead, they used a wave pattern with changing strength to avoid being caught. Each hacked device made about one request every nine seconds.
This careful timing meant no single source hit the usual rate limits, helping the overall operation stay under normal detection levels. The planned breaks between attacks allowed security measures to reset. During these breaks, the attackers changed addresses, switched user agents, and sent their payloads again. This smart timing shows a controlled operation where a person watched for detection signals and changed plans as needed.
To carry out an attack this bigger, the threat actors used a very broken network with over sixteen thousand independent systems. Getting to this level of spread needs great planning and special resources.
The traffic was very even, with the biggest network only making up 3% of the total. The attackers mixed their traffic by using popular cloud services like Cloudflare, Amazon, and Google, along with lesser-known networks that offer anonymity.
Providers such as 1337 Services GmbH and Church of Cyberology were utilized to minimize a traceable footprint.
By mixing traffic from standard hosting environments with privacy-oriented networks, the malicious operators created a complex web that made standard blocking completely ineffective, as reported by DataDome.
The adversary profile indicates a highly distributed but moderately sophisticated attacker who prioritized raw throughput over individual node stealth. Catching an operation of this complexity requires analyzing behavioral baselines rather than just aggregate traffic spikes.
Defenders found the attack by using server fingerprinting, threat data, and behavior analysis. They saw differences between the claimed browser setups and the real network features.
The automated tools used in the attack showed changing signals in each session, which is a clear sign of fake traffic. By looking at unusual session patterns and checking the mistakes within the fake environments, security systems reduced the threat for all users without affecting real ones.
