Azure hit by 15 Tbps DDoS attack using 500k IP addresses

Mad salt. Imagine a fully grown man having a toddler tantrum. "If I can't play/win/get my way, nobody can" type mentality. It's also a method of coercion. Give me mod status or I'll DDOS your server and destroy your community.

The other half comes from sever operators ddosing their competition. There is a lot of money to be made from paid cosmetics, ranks, moderator (demi-tyrant) status, etc on custom servers.

Probably it has to do with all the gambling sites associated with gaming not the games itself.

Taking a competitor offline for a few hours is a lot of money in a market business I expect.

there seems to be lot of weird stuff going on with gaming casinos the recent CoffeeZilla episode comes to mind, so wouldn’t be surprised if botnets are used

They get banned for trolling, griefing, cheating, breaking rules etc. and want revenge. Every game operator has to deal with idiots like this

the ddos market has been somewhat centered around gaming for a while now, mainly to take down game server competition, or as an attempt to sell big players on "ddos protection" services.

well, gaming and Krebs's blog: https://krebsonsecurity.com/2025/05/krebsonsecurity-hit-with...

It depends on the game, but for those with some kind of marketplace or transferable currency, I'm guessing market manipulation is one possible reason.

For other games, maybe trying to interrupt some time limited event or tournament. Going all the way down the rabbit hole, if you're not already familiar take a look at how crazy things get in a game like EVE: Online.

Then of course there are the bored trolls and/or people who feel wronged by the game's developers or other players.

Depends on How much does it cost to hire it

Most of the time its just blackmail/extortion - pay us or we do the thing.

> So why? Like why would someone pay to take a game down? I see this all over reddit with different games but I just don't get the point. What's the benefit of taking down an online game for a couple of hours.

Most of the time crime groups are running extortion campaigns, amplification campaigns, etc. For example, if a competitor can benefit from them being down you may be able to sell that. Eventually we will probably see the invention of crowd-funded randsomware, where everyone must submit one verification can of crypto to unlock the hacked game servers.

Extortion. You got a nice little game server there. Would be a shame if anything happened to it.

Uh I used to get DDoSed by “booter” services whenever I would login to one of my Skype accounts. The script kiddie scene is that petty. In the private server scene one guy would DDoS competing servers that way everyone would funnel to his own.

Its just toxic behavior.

The results are very public, it's the same way IRC is often targeted. They're easy targets, thousands of users are affected and the results are immediately noticeable.

I'm surprised no one has mentioned duping. Selling items and currency for real world money is big bucks and IME, server crashes reliably enable duping exploits.

Not saying that's the case in this particular incident though.

What is even more interesting why attack Azure? It's not possible to extort anything from Microsoft, so what's the rationale?

I've always imagined somebody will get pissed-off at me one day for banning them for bad behavior, or because I said something wrong online.

A game I work with got hit by ~10Tbps earlier this year. It's likely because someone got mad they were banned.

A satisfying theory for a lot of DDoS would be extortion or protection rackets. Pay up or we will DDoS you, or pay up or 'someone else' will DDoS you.

That's enough to explain it. But if you wanted to go more full shadowy conspiracy theory, someone arranged for a protection service that just so happens to work by giving some entity cleartext surveillance over much of the internet. Perhaps as a response to HTTPS everywhere being annoying.

I'm not suggesting that's the situation, but that it's the kind of possibility to keep in mind, intellectually, and it would be consistent with history.

Gamers, am I right?

competitors might want to drive users to move away if they think a platform is broken

> So why? Like why would someone pay to take a game down?

esports gambling is big business

> So why? Like why would someone pay to take a game down?

esports gambling and winning tournaments is big business.

> During the Fortnite Championship Series finals, a pair of pro players may have utilized denial of service attacks to disadvantage contesters [1]

[1] https://fortnitetracker.com/article/1087/ddos-scandal-from-c...

> What's the benefit of taking down an online game for a couple of hours.

Competitive MMO. Imagine some event is setup to start at some time and your guild or alliance knows they're gonna lose it and the resource it gives: DDOS the server so it's down during the event so it does not run. Enjoy the fact you kept the asset linked to said event and sell the resources you get for real money.

If you've never played those kind of games you cannot fathom how cutthroat they can become. I'm part of a guild which has a specific intelligence branch with spies embedded in many other guilds and that's playing nice because we're not selling anything.

Speculation online as to the why in this case, it's pure advertisement of their capabilities.

It may be for market manipulation. It may be extortion against the owning company. It may even be to take down a rival online game for a while.

I don't expect the big publisher games like PUBG to attack each other with DDoS attacks, but casino games? Or even sleazy Minecraft servers? I can totally see it.

You are questioning the human nature.

You have a Minecraft server. You generate money from it (selling VIP packages, et cetera). You could generate more money if you had more players. You can have more players if you consistently DDoS other more popular servers; the experience for these players will be horrible and they might give your server a chance.

This is exactly why OpenWRT has no unattended updates by default )

As always, hundreds watch the open repositories, maybe one watches a company's build servers, if they're lucky. :-)

Digital signing wouldn't defend you from a compromised build server.

I don't follow.

> run an army of security people

Do you think these private companies do this? They don't. They pay as little as humanly possible to cover their ass.

Botnets comprised of compromised routers is common and commercial/consumer routers are a far juicer target than openwrt.

Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update.

The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected.

This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://openwrt.org/docs/guide-developer/security#reproducib...

The post is nothing more than "but what about security" meant to deflect away from the discussion at hand and towards OpenWRT

I recently had some issues getting one of our embeded devices connect through passive ftp. Because the exact same device worked at a different site I knew it wasn't the device or it's settings. Long story short, it turned out the problematic site hadn't been updating its routers which meant they couldn't VPN passive FTP traffic. Anyway, we have literal thousands of those routers maintained by hundreds of different companies, who are mainly there to maintain the actual mechanical equipment and not the network. Turned out the site where the technicians updated things weren't in the majority.

I'm in the process of getting the business to implement better security, and it's going better than you might expect. If it wasn't because having a plan for how to update your OT security is required to meet EU compliance, however, I doubt we would've done anything beyond making sure we could do passive FTP when it was needed.

As an example, there is still no plans to deal with the OT which we know has build in hardware backdoors from the manufactures. Wnich is around 70% of our dataloggers, but the EU has no compliance rules on that...

The economic costs of that fall on the (residential) ISPs and they aren't really incurring very much cost in additional bandwidth from the outgoing attacks. In most cases it will be 0. It's not 'good', as it could affect quality to a certain extent for other subscribers and it's theoretically possible it could result in a slightly higher transit bill, but ultimately it's just not really a problem for them.

Setting up the infrastructure to email customers and tell them they've got an infected device is just going to cause the subscriber to: A) Call customer support and tie up an agent who can't really tell them much - you're also going to have to train all your CS agents on these letters and what they mean. B) Complain on faceybook/Churn off your network. or C) They'll ignore it

About one in a million will fix the issue themselves.

That industry group would need to include the big cloud providers, and they also doesn't want to shut of abusive traffic.

This already happens in the Netherlands, your router will be put in quarantine mode and you have to prove that the "virus" is gone

This happened to me, at the time I thought it was strange but seeing this event happen it makes a lot more sense now

Some of these devices are controlled by the ISP. The TMobile 5G routers for example are pretty much black box devices controlled by TMobile. The home owner can't fix the device and has very limited access (via a mobile app) to 'manage' the device.

Because then the ISPs have to provide support on how to secure those devices.

Hmm is there a haveibeenpwned for IP addresses found in botnets? Perhaps correlated at the time of known incidents.

I would like to know if I'm serving a rogue machine and not been paying attention.

This has always been the elephant in the room. imho, US intelligence don't want this so congress won't do it. Intelligence controls or buys these botnets when they need them, so regulation here is always impossible to push, but in other countries is more common.

Yup, many links I have tried to access without success. Well, sucks to have such a centralized Internet.

I am surprised no one has mentioned that today is Microsoft's conference keynote.

Most of the compromised devices are routers or IoT devices, functionally no compute power to do anything interesting except spam IPs with requests.

You could easily get better performance with a pair of well-optimized high-density cabinets, much more reliable and not even that expensive to operate legitimately.

It was interesting to read that the record breaking attack caused no glitch whatsoever in the service MS provides. Which is so slow normally that I start to wonder if that is a strategy, having headroom for these kind of situations, no-one realizes slowdown when it is already slow. ;)

This is just a crazy thought, tangential to what are happening during an attack.

I don't doubt there will have been sporadic examples of this, but what points to this "often" being the case? It seems like a tactic that wouldn't often pay off, since DDoS mitigation rarely involves relaxing security systems

Mistakes can be made during reconfigurations but you'd have to catch those while the issue is still live. Sounds like an advanced threat actor and not the run of the mill ransomware people (not that they're necessarily unsophisticated, but why'd they bother with these odds when there's low-hanging fruit to reliably exploit)

The "S" in IoT stands for "security".

> There's gotta be a better way.

Until then... There's gonna be a bigger wave.

fun fact, part of the reason this botnet exists is because europe required the ability to install security updates unattended that you cannot disable and they compromised one of the servers that had the capability to push these updates compromising hundreds of thousands of routers.

I suppose ISPs could be more restrictive about which routers they allow their customers to use, but I'm not sure I'm a fan of further lockdown in that department.

I mean, America can’t do anything about scam phone calls aimed at seniors who forge caller ID of local hospitals.

How would you even enforce this if the offending country doesn't agree?

I'm sure you could come up with at least few ideas why it hasn't happened

America gonna allow someone else to regulate them?

Because it's not technicaly possible, I mean we're on HN, we all know how internet works.

The international organisation for stopping wars, human trafficking, money laundering, drug distribution etc. however capable they might be, haven't managed to stamp out any of those things.

I'd say a putative UN NetWatch would suffer from the same issues of funding and corruption and politics, but still we might have something better than this wild west lawlessness.

Since this is a distributed attack, I'm not really sure how that enforcement would look like? Am I missing something, are all these bots/zombies easily selectable and blockable?

Perhaps because, in many cases, the very governments responsible for enforcing it include the bad actors themselves.

International DDoS busts and arrests do happen all the time.

Law enforcement takes time. The perpetrators of these attacks aren't hanging out in the open with their full names shielded only by the hope that their country won't extradite for political favor.

By the time the perpetrators are identified and a case is built, getting them charged isn't bottlenecked on the lack of an international agency. Any international law enforcement agency would be beholden to each country's own political wills and ideals, meaning any "teeth" they had would be no more effective than what we currenly have for extraditing people or cooperating with foreign police organizations.

the real reason why these are a problem in the first place is because of cgnat and transit providers not implementing flowspec.

but these bad actors are not possible to track down in the first place since internet is unfortunately decentralized and things as simple as transactions submitted to bitcoin or etherium blockchain can be used as c&c

Because countries benefit from conducting cyber warfare, the most publicised of are north Korea and Russia which have large state sponsored hacking groups.

Legal systems are so convoluted and so colossally heterogenous - also very protective of their ways - around the globe that miniscule collaborations require grandiose efforts to initiate and maintain. No chance these fast paced adversaries will be caught by the interplay of several dozens of reluctant dinosaur legal systems.

Tangential: once I was targeted by a pretty primitive scam. More than 10 years ago (after someone I love was naive and inexperienced, having a medium amount stolen in a sensitive and stressful time of this person's life). I recognised fast and having time and will I sarted to play along, pretending I bite the bait. Collecting info while acting. In parallel trying to connect local and international authorities to report an ongoing scam effort. I believe I tried 4 organizations in 3 different countries apparently involved, I believe one was dedicated to online scams, also trying to warn Western Union, they are about to be used for scam. I even went personally to a police station locally to get some advice on how to assist catching the criminals. Since all I encountered insisted to report my damages, so they could start an investigation on an actual loss happened, I furiously gave up and decided whenever I will be having financial trouble I will invest my efforts in scamming others. No-one cares catching those in act! So the thugs can be incredibly bold and dumb, like the one I encountered, it is no effort doing better.

It's national interest of China and Russia to see the West to fail. Why would they co-operate? They are willing to murder people, West and their own, so "law" enforcement means a bit different in international context.

If we were all running IPv6, we could just block this crap.

But here we are in 2025 still running IPv4 with CGNAT, so we can't.

Because every single nation would have to sign on to it allowing said agency to ignore sovereignty of each nation to come in and do their policing.

You'd also need to have every country not actively involved in these types of schemes yet we know some governments are directly benefiting from the scams/theft their citizens are perpetrating.

You'd also need to have every country think the things you want to police against are wrong. Again, we know that's just not true.

do you really think for example America would allow say Chinese prosecutors to arrest Americans on American soil and take them abroad to sentence them in a court that America has no influence over and then throw them in a prison which America doesn’t control?

Those exist but they might have a different idea of what makes an actor bad than you and I. Just look at what happened to Julian Assange.

What countries do you think these bad actors reside? Russia, China, Iran, and NK will wipe their ass with any law enforcement request.

Who would they take orders from?

many countries sponsor these attackers

Who is going to elect and oversee them? I don't want to be governed by China or Russia.

> international law enforcement agency

You mean Team America, World Police?

Besides the fact that not much happens in the international public sector, law enforcement is more about deterrence than prevention. Criminals aren't deterred by law enforcement, so the bad actors never stop. Human nature's a bitch.

If they did focus on prevention instead, most of this could be... prevented. Create a treaty that mandates how critical infrastructure technology is created/sold. Consumer routers will stop being shit at security, and home devices are slowed-down in upstream spamming. That's a good chunk of the denial-of-service market gone, with no need to police the world.

...but the criminals are smart and intentionally avoid attacking the powerful, so nobody cares. Same reason organized crime still exists. It's poor people caught up in gang violence and crime, not rich people, so it persists.

You can assume that you are part of it or another similar botnet if you have any IoT device exposed to the internet. You can use something like Shodan to see how your network looks like from the outside

it's an open secret at that point and the attacks are far larger than that are causing congestion world-wide from the time they wake up to the time they go to sleep.

Why wouldn't microsoft advertise this though? If they had the ability to take the attack and others might not, then it'll result in more customers for them.

nope, there's really no cost to it - they've been hitting with attacks double or even triple the size towards random minecraft hosts for months now.

we were getting hit with attacks like this daily at some point and were forced to use cloudflare magic transit it's pretty random and you shouldn't read too deep into it as nearly every anti-ddos solution, host and isp has been hit with this botnet by now.

You are assuming that DDoS is signal. It's not, it's the noise.

The idea of DDoS for hire is to bury your own tracks in as much network requests as possible, so that the other side is overwhelmed processing (or even storing) that dataset and won't find out what the real target was.

That's literally the strategy of APT28/29.

It's just a couple of local Aussie nerds beefing again. Simmo broke up with Jonno's sister via IM, so feelings were hurt.

This did not age well!

Yeah. That falls in the same bin as number of Olympic swimming pools or distance to the moon.

The best, meaningful comparison I've read is from Bill Bryson in A Short History of Nearly Everything. In it, he notes that there are 1M seconds in 11 days but 1B seconds takes 32 years.

An regular user would associate 4k is premium / expensive and difficult to use without better phones/network/plans/signal strength etc so the idea would be to be signal it is 1M times with a somewhat challenging thing for them.

Non-tech savy users know how live streams crash with sports like with Netflix recently during boxing etc or on Twitter last year and usually those come with some n Million users in kind of headlines or the like, so they have some reference to that scale.

As analogies go, there are worse examples. BleepingComputer is hardly the New Yorker or Atlantic, best we can hope for these days is a human is writing the article I suppose.

I've always disliked the "it's like X amount of [resolution] video!!" Are we talking a UHD 4K Bluray? or 4K Netflix? or 4K YouTube? Bitrate is all that matters.

Well I found it helpful for putting it into perspective.

Those redirects would crash Azure, i'm betting a grand

Yes.

Only way is to secure your IoT devices/routers/cameras/etc.

It's basically an ad.

"Look at how big of a botnet we have! Imagine all of that, but on the target YOU want to go down!"

It's how you do marketing, basically.

My Hue lights and vacuums would like a word!

Most "IoT botnet" devices are Wi-Fi routers and IP cameras. Which are the two classes of IoT devices that provide undisputed value.

Maybe, just maybe, people aren't as stupid as you think they are?

Anthropic agent went a little haywire on the tool use

Switched above. Thanks!

...and suddenly no one is allowed to VPN back through their home router.

We really shouldn’t - this seems like perhaps one of the worst ideas one could propose in an era of rising authoritarian rule. Seems like a bad time to be putting silly restrictions on how folks route their traffic.

Making them illegal seems far-fetched, but at this point something like email blacklists but for web services is becoming inevitable.

At the moment, that's what Cloudflare is doing. They're just not obvious enough, leading to people on forums (and here) asking "why do I constantly need to fill out captchas to enter websites".

breaking the law by using wireguard to access my home network, hmm, great idea.