VoIP Providers Hit by Multi-Vector DDoS Campaign
Over the last month, several Voice over Internet Protocol (VoIP) providers have come under fire from Distributed Denial of Service (DDoS) attacks carried out by groups claiming to be REvil. The campaign is notable for combining L7 attacks against critical HTTP sites and API endpoints with L3/4 assaults aimed directly at VoIP server infrastructure. In multiple instances, the attacks caused significant degradation to the targets' VoIP services and web availability.
Organizations facing DDoS attacks, ransom demands, or extortion attempts should seek immediate assistance to protect their Internet properties. Paying the ransom is not recommended; instead, report the incident to local law enforcement agencies.
Understanding the VoIP Attack Surface
VoIP encompasses the technologies that enable multimedia communication over the Internet—from FaceTime calls and Zoom classrooms to standard cellular calls that route over LTE. The underlying principle mirrors traditional circuit-switched digital calls, but the encoded media (voice or video) is broken into small payloads carried by IP packets according to specialized media protocols.
This packet-switched approach uses network resources far more efficiently than legacy circuit switching, making VoIP significantly cheaper than the public switched telephone network (PSTN). Businesses can reduce telecom costs by more than half after migrating, which helps explain why roughly one in three companies has already adopted VoIP. The technology's flexibility and scalability proved especially valuable for remote collaboration during the pandemic.
The dominant protocol for session control in VoIP is the Session Initiation Protocol (SIP), originally defined in RFC-2543 (1999). SIP was built to flexibly and modularly initiate voice or video sessions, whether between two parties or among many.
The Speed Paradox: Why UDP Creates Vulnerability
Quality VoIP depends on immediacy. Natural-sounding audio and smooth HD video require minimal lag, and providers closely track user perception through metrics like Perceptual Evaluation of Speech Quality and Mean Opinion Scores. While SIP and related protocols can run over either TCP or UDP, UDP is the typical choice—routers and servers can process its packets faster with less memory and computational overhead, enabling quicker reassembly of media payloads and better call quality.
But UDP is stateless, unreliable, and offers no Quality of Service guarantees. It has no concept of which packets belong to established calls versus those attempting to initiate new ones. That distinction lives in SIP headers, parsed higher up the network stack.
This design creates an inherent tension. VoIP infrastructure operates on a faster-is-better principle, processing packets first-come, first-served. Under normal load, that translates into superior performance. When an attacker pushes packet rates beyond capacity, the same principle becomes a liability. A traditional circuit-switched system refuses new connections once saturated while preserving existing ones. A VoIP server, racing to process everything, instead becomes incapable of handling the full flood—leading to latency and dropped packets for active calls and failed attempts to establish new ones.
How Attackers Exploit SIP and UDP
Attackers can overwhelm unprotected VoIP servers with floods of specially crafted UDP packets. One straightforward technique mimics legitimate call initiations. Each malicious SIP request forces the victim server to expend computational power and memory on authentication. A sufficient volume of these requests exhausts server resources, blocking legitimate call processing.
A more insidious variation is the SIP reflection attack. Instead of targeting the victim directly, the attacker sends spoofed call initiation requests—with the victim's IP as the source address—to thousands of unwitting SIP servers across the Internet. Those servers respond to the spoofed source, flooding the victim with unsolicited replies. The victim must then expend resources discerning legitimate from bogus traffic, creating a widespread denial of service.
Recent attacks against Cloudflare-protected VoIP infrastructure illustrate the scale. One multi-vector UDP attack peaked around 70 Gbps and 16 million packets per second, lasting over ten hours before automatic mitigation kicked in. A similar attack sequence from the same week against SIP infrastructure topped 130 Gbps and 17.4 million packets per second, leveraging DNS reflection and other amplification vectors alongside spoofed traffic.
Protecting VoIP Without Sacrificing Performance
The critical requirement for VoIP protection is speed: adding latency to a real-time communications service undermines its core value proposition. Anycast architectures and the scale of a large edge network can minimize—or even reduce—latency for protected traffic relative to public Internet routing. Independent testing on a real customer network demonstrated an average 36% performance improvement worldwide using such an approach.
Rather than routing traffic to centralized scrubbing centers, the most effective defenses operate at the edge. Every packet ingested at a data center is examined for DDoS characteristics through multiple out-of-path detection layers, avoiding added latency. Once an attack is identified, the edge generates a real-time fingerprint of the attack packets and matches it in the Linux kernel eXpress Data Path (XDP), dropping malicious traffic at wirespeed without collateral impact on legitimate packets. Additional mitigation rules inspect UDP traffic to determine whether it constitutes valid SIP communications.
These detections run autonomously within each edge server, with threat intelligence shared across the network to inform other points of presence. The system is fully tunable: operators can use managed rulesets to adjust DDoS protections or craft custom deep-packet-inspection firewall rules to enforce a positive security model on their traffic.
As reliance on remote communications continues, keeping VoIP providers online is more than a technical concern. It is about ensuring that friends, families, and colleagues stay connected without interruption—and without yielding to extortion demands.
