Microsoft mitigated a 3.47 Tbps DDoS attack, the largest one to date

Microsoft announced to have mitigated a record 3.47 Tbps distributed denial of service (DDoS) attack targeting an Azure customer.

Microsoft announced that its Azure DDoS protection platform has mitigated a record 3.47 Tbps attack that targeted one of its customers with a packet rate of 340 million packets per second (pps). The news of the attack was reported in the “Azure DDoS Protection —2021 Q3 and Q4 DDoS attack trends.”

“In November, Microsoft mitigated a DDoS attack with a throughput of 3.47 Tbps and a packet rate of 340 million packets per second (pps), targeting an Azure customer in Asia. We believe this to be the largest attack ever reported in history.” reads the report. “Attack vectors were UDP reflection on port 80 using Simple Service Discovery Protocol (SSDP), Connection-less Lightweight Directory Access Protocol (CLDAP), Domain Name System (DNS), and Network Time Protocol (NTP) comprising one single peak, and the overall attack lasted approximately 15 minutes.”

The attack took place in November and hit a customer in Asia, it originated from approximately 10,000 sources and from multiple countries across the globe, including the United States, China, South Korea, Russia, Thailand, India, Vietnam, Iran, Indonesia, and Taiwan.

The 3.47 Tbps attack was the largest one Microsoft has mitigated to date, likely the massive one ever recorded.

The IT giant also reported that other two massive DDoS attacks targeted Asian Azure customers in December, they peaked at 3.25 Tbps and 2.55 Tbps respectively.

Microsoft pointed out that as with the first half of 2021, the majority of the DDoS attacks were short-lived, experts observed a rise in attacks that lasted longer than an hour, with the composition more than doubling from 13 percent to 27 percent. The researchers warn that multi-vector attacks continue to remain prevalent.

In October, Microsoft announced that its Azure cloud service mitigated a 2.4 terabytes per second (Tbps) DDoS attack at the end of August, it represented the largest DDoS attack recorded to date, but the recent attack overwhelmed it. The attack hit the Russian internet giant Yandex and was launched by a new DDoS botnet, tracked as Mēris (Latvian word for ‘plague’).

“The concentration of attacks in Asia can be largely explained by the huge gaming footprint10, especially in China, Japan, South Korea, Hong Kong, and India, which will continue to grow as the increasing smartphone penetration drives the popularity of mobile gaming in Asia.” concludes the report. “In India, another driving factor may be that the acceleration of digital transformation, for example, the “Digital India” initiative11, has increased the region’s overall exposure to cyber risks.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Azure)