Experts noticed the reorientation of DDOS attacks on the regions
The DDOS attacks recorded by IB specialists on Russian companies in 2024 are almost twice the volume in 2023. It is noteworthy that regional companies are increasingly the goals of network attacks. Experts call among the reasons the search for hackers of more vulnerable victims, but also a geopolitical environment.
In the geography of DDOS attacks, a trend for reorienting the goals of attackers from Moscow to the regions was noted, experts of Solar Group of Companies told Kommersant: “The capital still holds leadership in the average number of attacks on one company (192 incidents in 2024), but in the past year, hackers sent their capacities to the regional business.”
So, in the Southern Federal District, the indicator for the whole year has grown one and a half times, up to 135 cases per company. In the Volga – twice, up to 126, in the Urals – also twice, up to 116.
In general, for 2024, according to the SOLAR Group of Companies, 508 thousand DDOS attacks on Russian organizations were recorded-this is almost twice as much as a similar indicator in 2023, but one and a half times less than in 2022. The average capacity of such attacks increased by 3.5 times in relation to 2023. Experts associate this with the fact that attackers began to use more powerful botnets (networks from a large number of devices used for high -power cyberstakes). Roskomnadzor recorded the most powerful attack in 2024 for more than four days. Then its power reached 2.38 Tbit/C, the goal was one of the providers of the hosting (see “Kommersant” dated January 30).
According to the Anti-DDOS service, the average number of attacks per company over the year increased by 1.8 times compared to 2023, to 132, however, the total share of the attacking organizations decreased by 6 p., To 69% a year by the year. “This suggests that hackers not only increased the capacities, but also began to carefully select the companies to achieve their goals, including in the regions,” explains Sergey Levin, head of the Anti-DDOS SOLAR Anti-DDOS.
Calling the tendency to increase DDOS attacks on the regions of “reorientation” is in no hurry in the Garda Group of Companies. According to the head of the analytics of the threats of the IB company Alexei Semenichev, physically attacked services and equipment could be in the regions, but relate to Moscow companies. “However, the attackers generally expand coverage, and even small regional companies become victims,” he adds. Local services for residents of regions can be more important than federal, but they have no such opportunities in terms of information security as large businesses. Attackers are aiming at them, because potentially the resources for a successful attack will need less, according to the Garda Group of Companies.
With the fact that the attackers are looking for more vulnerable regions for the attack, they agree to the Jet's Infosystems. In the regions there are a significant number of large companies whose business processes are critically dependent on Internet services, which have the degree of security below than in Moscow, said Nikita Stupak, head of the network and infrastructure security development direction.
Attacks on Russian resources as a whole in F6 (former Group-IB) are associated with the development of geopolitical tension around the country.
According to Elena Shamshina, the technical manager of the Threat Intelligence department, pro -Ukrainian ones remain the most active groups attacking the companies in Russia. “In 2024, many attacks were carried out on the part of one group to regions, especially the border regions – Kursk, Belgorod. But Internet providers were attacked in other regions. On the one hand, regional companies are relatively easy to attack – many before the beginning of 2022 did not think about serious cyber protection. On the other hand, we are talking about a PR effect, when such incidents attract increased attention, ”she notes.
