The telecommunications industry topped the charts as the most targeted by distributed denial of service (DDoS) attacks in the first quarter of 2021, according to a recent Cloudflare report. The industry managed to attract more attacks than consumer services, security and investigations, internet, and cryptocurrency.

“This is a significant jump from sixth place in 2020 Q4,” noted Omer Yoachimik, product manager of Cloudflare’s DDoS protection offering, in a blog post.

The report tracked DDoS attacks based on a variety of criteria including the target market, geographic source and destination, as well as the nature of the attack.

Where application-layer attacks — those that aim to disrupt an HTTP server’s ability to process requests — were concerned, Cloudflare reports that China received the largest volume of attack traffic during the first quarter, followed by the United States, Malaysia, and India.

Yoachimik notes that because IP addresses can’t be spoofed in an application-layer DDoS attack, the company was able to determine the source of these attacks were largely coming from within their origin countries, indicating the presence of “large botnets operating from within,” he wrote.

Ransom DDoS attacks also continued to be a challenge during the first quarter of 2021.

“Our customers on the non-Enterprise plans were the most targeted by DDoS attacks. However, it’s not just the quantity of attacks that is high, but these customers also reported the highest number of ransom DDoS attacks,” Yoachimik wrote.

During the quarter, 13% of Cloudflare customers that had sustained a DDoS attack reported that they had been extorted as part of the attack or had received a threat in advance.

“This is a continued trend from 2020 Q4 where the number of extorted customers was 17%,” and included a Fortune 500 company targeted by the Lazarus Group, Yoachimik wrote. The Lazarus Group is based in North Korea, and was believed to be behind the WannaCry attack in 2017.

Meanwhile, network-layer attacks — those that target exposed network infrastructure like inline routers and other network servers — heavily impacted data centers in Rwanda, China, and Brunei.

The Cloudflare report found that almost 44% of these attacks occurred in January, with synchronize flag (SYN) packet flood attacks remaining the most common. Other attacks noted included reset flag (RST) packets, user datagram protocol (UDP), and domain name system amplification attacks.

January may have been the busiest month for network-based DDoS attacks, but Cloudflare reports that the largest attacks actually occurred in February, peaking in the 300 Gb/s to 400 Gb/s range.

“Attacks with high bit rates attempt to saturate the internet link, while attacks with high packet rates attempt to overwhelm the routers or other inline hardware devices,” Yoachimik explained.

So while the very largest DDoS attacks observed during the quarter reached 400 Gb/s, more than 97% were smaller than one million packets per second, or 500 Mb/s.

That’s not to say smaller attacks are harmless, Yoachimik noted. “Attacks under 500 Mb/s are often sufficient to create major disruptions for internet properties that are not protected by a cloud-based DDoS protection service,” he wrote.

This is because many organizations have uplinks provided by their service providers with less bandwidth capacity than 1 Gb/s, meaning large-volume attacks are not necessary to have their intended effect.

Further complicating the issue is the duration of attacks, which for 90% of cases lasted under an hour, the Cloudflare report found. These bursty attacks are often employed in an attempt to circumvent DDoS protection systems, Yoachimik wrote.

“DDoS services that rely on manual analysis and mitigation may provide to be useless against these types of attacks because they are over before the analyst can identify the attack traffic,” he wrote. Short attacks are often also used to probe the cyber defense of the target.“

The report also detailed the rapid rise of three emerging threat vectors. These targeted Jenkins and TeamSpeak3 servers, as well as the quick UDP internet connection (QUIC) protocol, which grew 940%, 203%, and 433%, respectively, quarter over quarter.

Jenkins is a free open source automation platform designed to facilitate software development. Yoachimik explained that a vulnerability in an older version of the server aided the launch of DDoS attacks.

Teamspeak, on the other hand, is a voice-over-IP platform (VoIP) that operates over UDP, and appears to have been targeted in an effort to disrupt communication between teams in real-time multi-player games, thus impacting the team’s performance, Yoachimik wrote.

Finally, QUIC is a relatively new protocol that employs encryption by default. According to Cloudflare, attackers were able to mimic version negotiation packets by spoofing the IP address in order to overwhelm the client.