A Mirai Variant Tries to Flood Cloudflare's Network

Cloudflare's automated DDoS protection systems detected and mitigated a large UDP-based attack on July 3 that peaked at 654 Gbps. The assault was part of a ten-day, multi-vector campaign targeting a single Magic Transit customer and was handled without human intervention. The attack is believed to have been generated by Moobot, a Mirai-based botnet. The customer reported no downtime, service degradation, or false positives.

Campaign Breakdown

Over the ten-day period, Cloudflare's systems automatically detected and mitigated over 5,000 separate DDoS attacks against this one customer. The vectors included UDP floods, SYN floods, ACK floods, and GRE floods. The largest single event was a UDP flood that lasted only two minutes. This attack targeted a single IP address across multiple ports and originated from 18,705 unique IP addresses, each believed to be a Moobot-infected IoT device.

The attack was observed in Cloudflare's data centers across 100 countries. Roughly 89% of the attack traffic came from just 10 countries, with the US leading at 41%, followed by South Korea and Japan (12% each), and India (10%). This distribution suggests the malware has infected at least 18,705 devices globally.

About Moobot

Despite its benign-sounding name, Moobot is a self-propagating Mirai-based malware first discovered in 2019, according to Netlab 360. It infects IoT devices—such as security hubs, cameras, smart TVs, and sensors—by exploiting remotely accessible vulnerabilities or weak default passwords.

Once a device is infected, control transfers to the operator of a command and control (C2) server. The operator can issue remote commands to launch attacks or scan for additional vulnerable devices to infect. Moobot shares core capabilities with Mirai:

  • Self-propagation: After infection, the malware randomly scans the Internet for open telnet ports and reports back to the C2 server. The server then attempts to breach these devices using known vulnerabilities or brute force with common or default credentials.
  • Synchronized attacks: The C2 server coordinates a flood of packets or HTTP requests to create a denial of service event for the target.

Operators may deploy multiple C2 servers across different regions, assigning infected devices by region or module—one server for propagation and another for attack launch. If law enforcement takes down one C2 server, only part of the botnet is deactivated.

Why the Attack Failed

This is the second large-scale attack observed on Cloudflare's network in recent months. The previous one peaked at 754M packets per second, attempting to overwhelm routers with packet rate; that attack, however, maxed out at just 253 Gbps. This new attack took the opposite approach: a high bit rate attempt to saturate Internet link capacity.

Cloudflare's global network capacity exceeds 42 Tbps and is growing, spanning more than 200 cities in over 100 countries. The network interconnects with over 8,800 networks globally. This interconnectivity, combined with Anycast routing, allows the network to absorb even the largest attacks. No link saturation occurred during this event.

Once traffic reaches an edge data center, it is load-balanced by Unimog, Cloudflare's custom Layer 4 load balancer. Unimog uses appliance health and other metrics to distribute traffic intelligently, avoiding overload on any single server. The company also employs automatic and manual traffic engineering methods, overseen by a 24/7/365 Site Reliability Engineering team, to manage sudden shifts in traffic loads.

Automated DDoS Defense Systems

Incoming traffic encounters three software-defined DDoS protection systems:

  1. Gatebot: A centralized detection and mitigation system for globally distributed volumetric attacks. It operates from the network's core, receiving samples from every edge data center, analyzing them, and automatically sending mitigation instructions. Gatebot is also synchronized with customer origin servers to assess their health.
  2. dosd (denial of service daemon): A decentralized system running autonomously in each server at every data center. It analyzes traffic and applies local mitigation rules at high speed, improving network resilience by delegating detection to the edge.
  3. flowtrackd (flow tracking daemon): A TCP state tracking machine for handling randomized and sophisticated TCP-based attacks in unidirectional routing topologies, such as those used by Magic Transit. It identifies connection states and drops, challenges, or rate-limits packets that are not part of a legitimate connection.

These systems sample various traffic data, including:

  • Packet fields: source and destination IP, source and destination port, protocol, TCP flags, sequence number, options, and packet rate.
  • HTTP request metadata: headers, user agent, query string, path, host, HTTP method and version, TLS cipher version, and request rate.
  • HTTP response metrics: error codes from origin servers and their rates.

The systems analyze these data points in real time to detect anomalies. When an attack is found, a mitigation rule with a dynamically crafted signature is generated and propagated. For example, a Layer 7 HTTP flood might be dropped at Layer 4 to conserve CPU.

Rules from dosd and flowtrackd are applied locally for rapid mitigation. Gatebot's rules, however, are propagated to all edge data centers and take priority over dosd's rules. In this attack, dosd generated local rules initially. When Gatebot recognized the global distribution, it pushed unified mitigation instructions across the entire network, preparing all 200+ data centers in case the attack traffic shifted due to Anycast or traffic engineering.

No Extra Charges

Beyond the risk of downtime, DDoS attacks pose a financial risk from mitigation costs. Over the ten days, the botnet generated more than 65 Terabytes of traffic. However, under Cloudflare's unmetered DDoS protection guarantee, the customer was not billed for any of the attack traffic. The traffic is automatically excluded from billing systems, so no retroactive credit requests are needed. The financial risk is eliminated.