BAKU, Azerbaijan, April 27. Most cyberattacks on Russian networks in the first quarter of 2022 came from hacktivists expressing their social protest and seeking no financial or other benefits, Alexander Lyamin, the founder and CEO of the Russian Qrator Labs company, told Trend.
According to Lyamin, DDoS activity directly related to the events in Ukraine was at a record high during the reporting period.
"The hacktivists are disparate groups of people, united only by the motivation to suppress various web resources and online services in the course of a socio-political conflict,” he said. “Such groups usually lack leadership, and as a means of coordination for choosing the target of the attack, its methods, and timing, they use ordinary messengers.”
Besides, according to the CEO, during the reporting period, there was registered an incident involving a record 901,600 devices.
"The majority of the cyberattacks accounted for Application Layer (L7) attacks. They use encrypted traffic and requests similar to the traffic of legitimate users. Cleaning such traffic requires large computing power, so this class of attacks is the most difficult to detect and filter,” Lyamin explained.
“The top cyberattacks have also included attacks on encrypted TLS handshake traffic. TLS handshake means HTTPS connection setup stage, within which all the cryptographic work is done to make a secure connection,” he noted. “The TLS handshake attack technique is the most accessible for attackers and is also extremely effective due to the fact that many telecom operators don’t support TLS analysis for protection against DDoS attacks.”
The CEO also noted that a large proportion of the techniques used to organize L7 attacks fall on Request Rate Patterns and Broken HTTP Semantics (25.9 percent and 35.13 percent, respectively), which is typical for tools popular with hacktivists - LOIC/MHDDoS.
“Namely hacktivists use these most easy-to-use techniques to organize cyber protests, while, for example, more sophisticated attacks use full-fledged web browser emulation, which complicates their detection and filtering,” added Lyamin.