Threat Bulletin 0395: HTTP GET flood against a B2B SaaS platform in North America

On Saturday 27 August 2022 at 05:56 UTC, a HTTP GET flood targeted a B2B SaaS customer in North America. The attack peaked at 190.8 million requests per second and lasted 29 minutes. Traffic originated from 1892 autonomous systems in 77 countries, predominantly a Mirai-derived IoT botnet.

Vector HTTP GET flood
Peak 190.8 million requests per second
Duration 29 min
Time to mitigation 0.419 s
Attack traffic reaching origin 0.083%
Legitimate traffic challenged 0.05%

Timeline

The attack was preceded by an extortion email received two days earlier. Request rates on the targeted routes exceeded their hourly baseline by a factor of 585 within 18 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

The customer’s status page stayed green throughout; they learned about the attack from our notification.

Recommendations

  • Lower challenge thresholds on authentication endpoints during high-risk events.
  • Enable log streaming to your SIEM for faster correlation.
  • Add a dedicated rate limit for the targeted route.

1 thought on “Threat Bulletin 0395: HTTP GET flood against a B2B SaaS platform in North America”

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top