Threat Bulletin 0161: GRE flood against a crypto exchange platform in North America

On Sunday 10 October 2021 at 00:34 UTC, a GRE flood targeted a crypto exchange customer in North America. The attack peaked at 206.5 Gbps and lasted 132 minutes. Traffic originated from 1001 autonomous systems in 94 countries, predominantly misconfigured open reflectors.

Vector GRE flood
Peak 206.5 Gbps
Duration 132 min
Time to mitigation 0.600 s
Attack traffic reaching origin 0.000%
Legitimate traffic challenged 0.66%

Timeline

The attack was preceded by a breaking political story. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 28 points of presence.

What the customer saw

A brief increase in p99 latency of 130 ms during the first minute, then normal service.

Recommendations

  • Review allow-listed partner ranges quarterly.
  • Enable authenticated origin pulls.
  • Enable log streaming to your SIEM for faster correlation.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top