Threat Bulletin 0607: TLS handshake exhaustion against a fashion retail platform in Central Europe

On Wednesday 21 June 2023 at 06:03 UTC, a TLS handshake exhaustion targeted a fashion retail customer in Central Europe. The attack peaked at 239.8 million requests per second and lasted 144 minutes. Traffic originated from 1287 autonomous systems in 84 countries, predominantly compromised cloud VMs.

Timeline

The attack was preceded by a ransom note demanding payment in Monero. Request rates on the targeted routes exceeded their hourly baseline by a factor of 578 within 22 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

Checkout conversion was unchanged compared with the same hour of the previous week.

Recommendations

• Add a dedicated rate limit for the targeted route.
• Keep origin IPs out of public DNS history.
• Lower challenge thresholds on authentication endpoints during high-risk events.