Russian state-owned financial organization, Sberbank, recently faced a significant security challenge, reporting the most powerful distributed denial of service (DDoS) attack in its recent history. The attack, which occurred two weeks ago, involved an unprecedented one million requests per second (RPS), approximately four times larger than any previous DDoS attack the bank had encountered.
Furthermore, the assault coincided with the aftermath of Russia’s invasion of Ukraine, resulting in international sanctions and blockades, making Sberbank a target for hacktivists aligned with western interests. The head of Sberbank noted that these attacks involved new, highly skilled hackers who systematically targeted major Russian resources, revealing an evolving cyber threat landscape.
While the one million RPS DDoS attack on Sberbank was substantial, it pales in comparison to recent record-breaking DDoS attacks using advanced techniques such as the ‘HTTP/2 Rapid Reset.’ In August, Amazon reported an attack peaking at 155 million RPS, while Cloudflare mitigated a 201 million RPS assault, and Google faced a DDoS attack peaking at a staggering 398 million requests per second. These numbers highlight the scale of the cyber threats that organizations are dealing with in the current digital landscape.
This isn’t the first time Sberbank has been targeted; in May 2022, the bank announced it had experienced unprecedented hacker attacks, including massive DDoS waves targeting its online customer services. Sberbank was able to repel a DDoS attack that measured at 450GB/sec, generated by a botnet comprising 27,000 compromised devices.
Additionally, the Russian financial system has recently suffered another blow as the National Payment Card System (NSPK), operator of the Mir card, faced an outage on October 30, 2023, and a subsequent defacement indicating a data breach. While the attackers claimed to have stolen data, NSPK stated that no sensitive customer information was at risk, and the cyberattack did not affect the payment system. The responsible parties, identified as hacktivists from the ‘DumpForums’ group and the Ukrainian Cyber Alliance, claimed responsibility for the attack.
References:
- Сбербанк около двух недель назад столкнулся с самой мощной DDоS-атакой
