2022 attacks! An August reading list to go “Shields Up”

2022 attack trends as a reading list

By mid-2022, the numbers were already striking: 4.95 billion people online, about 62.5% of the world's population, with growth estimated around 4% during 2021 and 7.3% in 2020. Cloudflare's network was blocking an average of 124 billion cyber threats per day, up from 117 billion in Q1'22, while serving nearly 20% of websites and operating in over 270 cities.

The context for the surge is well known: the war in Ukraine brought with it sustained cyberwar, prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to launch the Shields Up initiative. The UK and Japan issued similar warnings. In Cloudflare's own Q2 2022 data, application-layer DDoS attacks rose 72% year-over-year and network-layer attacks jumped 109%.

Two foundational posts on the state of play

Two blog posts provide the broader picture on attack patterns and preparedness. The first, "Shields up: free Cloudflare services to improve your cyber readiness," catalogs free services for websites, apps, and APIs, including DDoS mitigation, protection for teams and personal devices, and related work such as the CrowdStrike–Cloudflare Zero Trust partnership. The second, "In Ukraine and beyond, what it takes to keep vulnerable groups online," marks the eighth anniversary of Project Galileo, which protects human-rights organizations, journalism, and non-profits. Between July 2021 and May 2022, Cloudflare blocked nearly 57.9 million attacks per day for these groups—an increase of almost 10% over the prior year, totaling 18 billion attacks. The largest share of mitigated requests (28%) were classed as "HTTP Anomaly," 20% as SQL injection attempts, and nearly 13% targeted specific CVEs, including Spring4Shell, Log4j, and the Atlassian Confluence CVE-2022-26134.

DDoS attacks and mitigation

Distributed denial-of-service attacks remain the most visible threat type, often used in state-based conflict. Cloudflare detected and mitigated these automatically, with one notable case: a 26 million request-per-second attack against a customer on the Free plan, carried out by what is now the most powerful botnet on record, Mantis. Most attacks are smaller—cyber vandalism—but even those can badly hurt an unprotected site.

For trends, the Q2 2022 report shows that attacks of 100 Gbps and above grew 8% quarter-over-quarter and attacks lasting over three hours rose 12% quarter-over-quarter. In Q2, the most-targeted industry by DDoS was Broadcast Media in Ukraine, and the top five most-attacked industries were all in online media, publishing, and broadcasting. Cloudflare also extended real-time DDoS alertsto Free plan customers, notifying them when HTTP DDoS attacks are automatically detected and mitigated.

Practical tips for Free plan users

Omer Yoachimik highlighted three steps to make a Cloudflare free account more DDoS-resistant:

1. Put Cloudflare in front of your website: onboard your site and route all HTTP traffic through Cloudflare, then lock down the origin server so it only accepts traffic from Cloudflare IPs.
2. Use free security features:
   • DDoS Protection is on by default; you can also override rules to Block where the default action differs.
   • Security Level issues challenges automatically to low-reputation IP addresses; keep it set to Medium or higher.
   • bot protection on the free tier fends off simple bots and headless browsers by issuing expensive computational challenges.
   • Create up to five free custom firewall rules to block or challenge unwanted traffic.
   • Enable the Free Managed Ruleset to protect against high-impact, widely known vulnerabilities.
3. Cache aggressively: the fewer requests reaching your origin, the better—including malicious ones. Use Cloudflare's caching to keep as much content off your origin as possible.

Attack insights and strategies

The most powerful botnet to date

The 26M RPS attack highlights a specific technical milestone worth noting:

WAF Coverage and Managed Rulesets

Cloudflare's own traffic data gives a useful snapshot of the threat landscape at the application layer. Around 8% of all HTTP traffic that hits Cloudflare's network gets mitigated, which works out to roughly 2.5 million requests per second that never reach customer caches or origin servers. At the time of the March 2022 report, Layer 7 DDoS and Custom WAF rules were the top mitigated traffic sources, and the report also noted that the percentage of automated HTTP traffic had actually dipped to 31% (from an earlier figure of 38%). For API endpoints specifically, SQL injection remained the most common attack vector.

A notable shift during this period was the decision to make a WAF Managed Ruleset available by default on all free zones, at no cost. The move ties into Cloudflare's broader "help build a better Internet" mission, and it means that even sites without a paid plan get some baseline protection against high-severity vulnerabilities without any configuration work.

Client-side security also became a bigger focus. In December, all paid plans received access to Page Shield features, and the following month Cloudflare made malicious code alerts more actionable. The detection work behind Page Shield is aimed at identifying Magecart-style attacks — the kind of client-side skimming that led to significant GDPR fines for both British Airways and Ticketmaster.

Email Security: Phishing and the Area 1 Acquisition

Phishing remains the most common entry point for attackers. CISA estimates that 90% of cyber attacks begin with phishing, and the FBI has described Business Email Compromise as a $43 billion problem. That context helps explain why Cloudflare announced in late February that it had agreed to acquire Area 1 Security, a company that had built cloud-native technology specifically for defending against email-based threats.

The acquisition was notable because Area 1's technology was integrated into Cloudflare's global network, tying email security into the broader Zero Trust platform. Cloudflare itself was already using Area 1 as a customer for its own email security before the acquisition closed.

One concrete test of that setup came in August 2022, when Twilio disclosed that it had been breached by a targeted SMS phishing attack. Cloudflare saw a similar attack aimed at its own employees. The company says no Cloudflare systems were compromised, and it credited its Cloudforce One threat intelligence team with dissecting the attack and helping track down the attacker. The response also relied on Cloudflare One products and physical security keys.

Browser Isolation for Email Links

Zero Trust posture has a gap if email is not secured, largely because users implicitly trust email in a way that attackers exploit. To close that gap, Remote Browser Isolation can now be enabled for email links through Cloudflare Gateway. The idea is that even if someone clicks a malicious link, the threat never reaches their actual browser environment, providing protection across multi-channel email attacks.

On the account takeover front, Cloudflare had already documented how it protects its own applications against such attacks. For users interested in the deeper technical side, research from the previous year covers password security and the persistent problem of password reuse.

Ransomware and the shifting threat landscape

Ransomware remains one of the fastest-growing cyber threats, with attack volumes up 105% year-over-year according to a March 2022 Senate Committee report. The nature of these attacks is also evolving. Cloudflare's analysis of a targeted ransomware incident describes a scenario where critical systems suddenly stop operating and attackers demand payment to restore them, or launch a DDoS and demand ransom to make it stop. The rise of ransomware-as-a-service (RaaS) models has lowered the barrier to entry: "RaaS is essentially a franchise that allows criminals to rent ransomware from malware authors," making these tools accessible even to inexperienced threat actors.

For organizations looking to defend against this category of attack, Cloudflare recommends a layered approach:

• Enable 2FA everywhere, especially on remote access entry points, where Cloudflare Access plays a key role.
• Maintain multiple redundant backups of critical systems and data, both onsite and offsite.
• Monitor and block malicious domains using Cloudflare Gateway with antivirus.
• Sandbox web browsing activity using Cloudflare RBI to isolate threats at the browser.

A related and increasingly visible risk is the wiper malware, designed to erase the computers it infects. When a wiper was identified in Ukraine — taking down government agencies and a major bank — Cloudflare adapted its Zero Trust products to ensure affected customers were protected. Those protections were made available automatically to all customers, including many Ukrainian organizations under Project Galileo. The satellite provider Viasat was also affected by a similar incident in May 2022.

Zero Trust as a defensive ecosystem

Cloudflare's approach to security treats protection as part of an interconnected ecosystem rather than a set of isolated tools. Within its Zero Trust services, the company says it can provide defense against malware, ransomware, phishing, command-and-control traffic, shadow IT, and other Internet risks across all ports and protocols.

Since 2020, Cloudflare Gateway has handled malware detection and prevention directly from the Cloudflare edge. More recently, the company added its CASB product to secure workplace tools, personalize access, and protect sensitive data. The company's onboarding of a Fortune 500 customer under a targeted ransom DDoS attack demonstrates how these components work together in practice.

Threat intelligence and investigation

Cloudflare's Security Center now includes a threat investigations portal called Investigate, which lets all customers query Cloudflare's threat intelligence directly to streamline security workflows and tighten feedback loops. The intelligence behind this portal comes from the company's position protecting millions of Internet properties; data gleaned from attacks trains its machine learning models and improves the efficacy of its application security products.

A related development is the formation of Cloudforce One, Cloudflare's threat operations and research team. While the team will publish research, its primary objective is tracking and disrupting threat actors directly, with the goal of protecting customers against threats with minimal involvement required on their end.

Third-party scripts are another vector worth attention. Cloudflare's acquisition of Zaraz, announced in December 2021, supports cloud loading of third-party tools. Offloading these scripts can prevent problems ranging from code tampering to loss of control over data sent to third parties. As one Cloudflare engineer put it, "the third-party script can intentionally or unintentionally (due to being hacked) collect information it shouldn't collect, like credit card numbers, Personal Identifiers Information (PIIs), etc."

Getting started with stronger defenses

The Cloudflare Security Center is a practical entry point for testing some of these security features, with free plans included. The Zero Trust ecosystem, also marketed as Cloudflare One, is available as a self-serve offering with its own free plan. For those interested in tracking attack trends, Cloudflare Radar provides near real-time data on attacks, including a dedicated DDoS attack trends report for 2022 Q2.