Why the 2023 threat landscape demands a closer reading

With more than five billion people online as of July 2023, internet security has moved firmly into the mainstream. Attacks have grown more sophisticated, and governments have responded with a wave of policy documents and protective initiatives. Cloudflare’s own numbers help quantify what defenders are up against: in Q2 2023, the company blocked an average of 140 billion cyber threats per day, up 13% from the 124 billion daily average in Q2 2022.

Beyond the raw volume, threat actors are finding new footholds. AI and machine learning have become mainstream tools, raising questions about the quality of deception and even the possibility of AI-powered hackers. At the same time, critical infrastructure providers in education and healthcare have become more attractive targets.

Several free programs announced this year aim to shift the odds. Cloudflare continues to onboard customers while they are under active attack and has offered protections to major events like the 2023 Eurovision Song Contest voting system, which reached 162 million people. The company’s network also provides a vantage point: it connects over 12,000 networks from more than 300 cities across 100-plus countries, serving approximately 20% of websites online.

Policy gets practical

War in Ukraine shows internet resilience under fire

Cloudflare’s one-year retrospective on the conflict in Ukraine covers internet trends and attack patterns, and documents how the country’s connectivity remained largely resilient despite repeated disruptions. In early March 2022, application-layer cyber attacks in Ukraine rose 1,300% compared to pre-war levels, a spike that correlates with the early stages of the invasion.

[BLOCK_1]

The White House strategy calls on the private sector

In March 2023, the Biden-Harris Administration published its National Cybersecurity Strategy, a blueprint for preserving an open and interoperable internet. The strategy places a strong emphasis on defending critical infrastructure, a domain where Zero Trust architectures are central. Cloudflare responded by announcing a commitment to the 2023 Summit for Democracy, building on its earlier work such as the Critical Infrastructure Defense Project (launched March 2022) and Project Safekeeping (launched December 2022), which provides free Zero Trust solutions to eligible entities in Australia, Japan, Germany, Portugal, and the United Kingdom.

International agencies set a "secure by default" tone

An April 2023 guide from CISA and partner agencies in the US, UK, Australia, Canada, Germany, Netherlands, and New Zealand lays out principles for security-by-design and security-by-default. Standardizing on machine learning tools and default-secure postures, the argument goes, makes the whole ecosystem harder to breach.

Project Galileo turns nine

The June 2023 anniversary of Project Galileo brought new data on protecting vulnerable communities. Between July 1, 2022, and May 5, 2023, Cloudflare mitigated 20 billion attacks against organizations protected under the program, an average of nearly 67.7 million attacks per day. Highlights from the accompanying Cloudflare Radar report include:

  • LGBTQ+ organizations saw an average of 790,000 mitigated attacks daily, with DDoS making up the majority.
  • A wave of attacks aimed at a prominent organization peaked at 667,000 requests per second; before and after the attack, the site saw minimal traffic.
  • In Ukraine, traffic spikes to emergency response and disaster relief organizations coincided with bombing events over the ten-month window.

Free protections for smaller US school districts

Project Cybersafe Schools, introduced in August 2023 at the White House K-12 Cybersecurity Summit, offers eligible small K-12 public school districts a package of Zero Trust tools at no cost and with no time limit. The context for this move: in Q2 2023, Cloudflare blocked an average of 70 million cyber threats per day targeting the US education sector, with DDoS attacks alone rising 47% quarter over quarter.

Record-breaking DDoS attacks and privacy protections

Against this backdrop, it’s useful to see what a modern DDoS assault looks like. A listing of recent technical posts includes a breakdown of the record-breaking attack that peaked above 71 million requests per second. This section of the reading list also covers Cloudflare’s work on WAF attack scoring to stop attacks before they are widely known, and content scanning to block malware in uploads.

[BLOCK_2]

Privacy remains tightly coupled to security. Cloudflare has written about its investment in security to protect data privacy, and achieved validation under the EU Cloud Code of Conduct, a GDPR-focused privacy certification. For readers focused on the broader policy landscape, related posts cover the UK’s domestic strategy as well as approaches in Germany, Japan, and Australia, which have all updated their national cyber strategy documents in the last several months.

The first six months of 2023 saw attackers refine their tactics across the board, from DDoS campaigns to application-layer exploits to phishing lures. Cloudflare's own network data and threat research during this period offers a useful snapshot of where the threat landscape stood — and where it was heading.

DDoS activity: bigger, longer, and more coordinated

Cloudflare's Q2 2023 DDoS threat report documented what it called an unprecedented escalation in attack sophistication. Pro-Russian hacktivist groups Killnet, Anonymous Sudan, and REvil were observed coordinating strikes against Western targets. Exploits targeting Mitel vulnerabilities surged 532%, and attacks aimed at cryptocurrency platforms jumped 600%. The report also noted a 103% quarter-over-quarter increase in attacks lasting more than three hours.

The same quarter saw hyper-volumetric attacks leveraging botnets built from Virtual Private Servers (VPS), a trend first observed in Q1. In a notable February incident, Cloudflare mitigated dozens of these attacks, with most peaking between 50 and 70 million requests per second (rps). The largest topped 71 million rps — a record for reported HTTP DDoS attacks, and more than 54% higher than the previous record of 46 million rps set in June 2022.

Hacktivist groups also turned their attention to specific sectors. In late March, university websites in Australia came under HTTP DDoS attack from Killnet and Anonymous Sudan. Early February saw a similar uptick in targeted attacks against healthcare organizations by a group claiming to be Killnet. In both cases, Cloudflare published guidance alongside its observations, noting that protected sites saw the attacks mitigated automatically.

In April, researchers disclosed a new DDoS reflection and amplification vector leveraging the Service Location Protocol (SLP). Cloudflare noted that SLP-based attacks were expected to grow, though its automated edge DDoS protection was designed to absorb them. The same month, Cloudflare introduced an updated Network Analytics dashboard designed to give security teams a clearer view of their attack and traffic landscape.

Application-layer security: the WAF's growing role

Cloudflare's second annual Application Security Report, published this year, examined traffic trends across its network. According to Netcraft, Cloudflare had become the most commonly used web server vendor within the top million sites, holding a 22% market share.

Key findings from the report included:

  • An average of 6% of daily HTTP requests proxied by Cloudflare were mitigated, down two percentage points from the prior year.
  • DDoS mitigation still accounted for more than half of all mitigated layer 7 traffic.
  • Mitigation by the Cloudflare Web Application Firewall (WAF) grew to nearly 41% of mitigated requests.
  • HTTP Anomaly (including malformed method names and null byte characters in headers) was the most frequent layer 7 attack vector mitigated by the WAF.
  • 30% of HTTP traffic was automated bot traffic, and 55% of dynamic traffic was API-related. Browsers generated 65% of global API traffic.
  • 16% of non-verified bot HTTP traffic was mitigated.
  • HTTP Anomaly overtook SQL injection (SQLi) as the most common attack vector on API endpoints. Brute-force account takeover attacks were on the rise, and Microsoft Exchange was attacked more frequently than WordPress.

To help stop threats before they were known, Cloudflare announced in March that its machine learning-powered WAF and Security Analytics view were extended to Business plan customers. The approach combines early detection with automated mitigation. In April, Cloudflare integrated a content scanning engine with its WAF, allowing malicious file uploads from end users to be blocked before they reached origin servers.

Phishing: still the top entry point

Phishing remains the primary method for breaching organizations. CISA attributes 90% of cyber attacks to it, and the FBI's most recent Internet Crime Report ranked phishing as the top internet crime type. Reported phishing incidents grew 1038% since 2018, reaching 300,497 in 2022. The FBI also labeled Business Email Compromise (BEC) a $43 billion problem, with complaints up 127% in 2022 and losses of $3.31 billion.

Cloudflare's Area 1 email security service blocked 2.3 billion unwanted messages in 2022, a number the company expects to surpass this year. In August 2023, Cloudflare published its first phishing threats report, based on email security data from May 2022 to May 2023. The report found deceptive links to be the top phishing tactic, and noted that identity deception — including BEC and brand impersonation — was evolving to bypass email authentication standards.

Other phishing-related developments included:

  • SOC 2 Type II report: Cloudflare Area 1 obtained a SOC 2 Type II report, providing customers with third-party assurance for how their sensitive data is handled.
  • Email Link Isolation: Made generally available in January, this feature acts as a safety net for suspicious links that users may click, isolating them as a precaution within the Area 1 email security offering.
  • Brand impersonation defenses: In March, Cloudflare published a list of the top 50 most impersonated brands in phishing attacks — led by AT&T, PayPal, and Microsoft — and expanded phishing protections for Cloudflare One customers to automatically identify and block "confusable" domains.

Cloudflare also highlighted that its Cloudflare One platform, used in combination with physical security keys, was credited with thwarting the sophisticated "Oktapus" phishing attack that targeted Cloudflare employees.

New Threats in 2023: AI, Malware, and Evolving Attack Vectors

The threat landscape in 2023 extends well beyond the ransomware and DDoS attacks of previous years. New technologies and global events have created fresh opportunities for attackers. Cloudflare’s Security Center research highlights several of these emerging risks and the tools being developed to counter them.

The explosion of generative AI has created a new and vast attack surface. Securing these applications is a unique challenge, as their consumer-facing nature exposes the underlying AI systems to millions of potential attackers. Cloudflare has published best practices for protecting these workloads, drawing on its experience securing some of the world's largest AI applications.

In parallel, defense mechanisms are also becoming more intelligent. Cloudflare has developed proprietary machine learning models designed to detect security threats that exploit the Domain Name System (DNS), aiming to prevent malicious activity before it can cause damage.

Attackers continue to use topical events as lures to breach trust. The collapse of Silicon Valley Bank (SVB) earlier this year was one such event, triggering a wave of opportunistic phishing campaigns. In response, Cloudflare’s threat operations and research team, Cloudforce One, significantly increased brand monitoring focused on SVB's digital presence.

Tools for Application and URL Defense

Several new tools have been launched to help security teams. In April 2023, Cloudflare introduced a content scanning engine integrated with its Web Application Firewall (WAF). This allows the firewall to scan and block malicious file uploads before they ever reach an origin server. Later, in August, a blog post analyzed the most commonly exploited vulnerabilities of 2022, as reported by the Cybersecurity and Infrastructure Security Agency (CISA). Leveraging its position as a reverse proxy for a large portion of the Internet, Cloudflare detailed how these specific CVEs were being exploited in the wild.

The Post-Attack Landscape and Defense Strategy

"The Internet was not built for what it has become".

This line from Cloudflare's S-1 filing captures a central truth of modern security: the network of networks was never designed for its current, critical role. In an environment where anyone can be a target, security, performance, and privacy are paramount. While AI can help mitigate attacks, it also adds complexity to the tactics of attackers.

The optimal strategic approach remains focusing on prevention to stop detrimental outcomes from occurring in the first place. For organizations looking to put this into practice, several resources are available. The Cloudflare Security Center, which includes free plans, is a practical starting point for exploring security features. The Zero Trust ecosystem, also available as a self-serve product with a free plan, provides a path toward a more secure architecture. A vendor-agnostic roadmap can illustrate the general advantages of Zero Trust, with separate materials available for high-risk organizations.

Long-term defenses are also being prepared. In March 2022, Cloudflare enabled support for post-quantum cryptography for all its customers. This technology is designed to be secure against the future threat of quantum computers, ensuring protection is in place even before the risk fully materializes.