Threat Bulletin 1063: HTTP/2 rapid reset against a gaming community platform in Iberia

On Tuesday 25 March 2025 at 07:17 UTC, a HTTP/2 rapid reset targeted a gaming community customer in Iberia. The attack peaked at 532.6 million requests per second and lasted 129 minutes. Traffic originated from 1062 autonomous systems in 20 countries, predominantly a rented booter service.

Timeline

The attack was preceded by an extortion email received two days earlier. Request rates on the targeted routes exceeded their hourly baseline by a factor of 145 within 31 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

The customer’s status page stayed green throughout; they learned about the attack from our notification.

Recommendations

• Enable authenticated origin pulls.
• Lower challenge thresholds on authentication endpoints during high-risk events.
• Enable log streaming to your SIEM for faster correlation.