Arelion's latest Threat Landscape Report, a cybersecurity research paper, looks into the global impact of DDoS attacks, exploring the attack vectors and the effect of significant social and geopolitical events.



The study is based on traffic statistics obtained from Arelion's Internet backbone, AS1299. The report highlights Europe as being the region with the highest incidence of DDoS activity in 2022, which may be due to the conflict in Ukraine.

The market research reveals that DDoS attacks continue to play a vital role in geopolitical issues and societal conflicts and are increasingly used in hybrid warfare tactics.

Arelion reports a change in the distribution of assaults from active war zones to international cloud centers as Ukrainian authorities worked to safeguard digital state records and databases. This transition was influenced by the destruction of local network infrastructure and the deliberate transfer of local databases and applications to the cloud.

Interestingly, there was a drop in DDoS activity between Asia and the U.S., as well as between South America and the rest of the world.

The findings indicate that peak attack traffic grew by 19% from 2021 to 2022 in terms of attack dispersion and intensity, with attackers focusing on fewer but more damaging assaults. However, most of the attacks remained minor and were initiated by inexperienced hackers using free tier stress test or DDoS-as-a-Service tools. Arelion observed a noticeable increase in assaults in the 5-20 Gbps and 20-50 Gbps areas due to the high amplification factor of DNS, NTP, and memcache-based attacks.

DDoS attacks on Arelion's global backbone decreased by over 30% in 2022 thanks to programs like the DDoS Traceback Working Group, which tackles faked traffic. The company also saw a 50% drop in DDoS attacks on its clients.

In response to the report's findings, Mattias Fridström, Chief Evangelist at Arelion, stressed the importance of customer protection against smaller DDoS attacks and the need for strong insurance coverage to handle larger-scale attacks. Mr. Fridström noted that network and IT infrastructure owners are taking more proactive measures in the DDoS arms race.

DDoS attacks have been observed to play a significant role in shaping geopolitical dynamics in several ways:

1. Cyber Warfare and State-Sponsored Attacks: Nation-states increasingly use DDoS attacks as part of their cyber warfare strategies. These attacks can target critical infrastructure, government systems, and military assets. They serve as tools for intelligence gathering, disrupting enemy communication and command structures, or even causing economic damage to rival nations. DDoS attacks offer a means of asymmetric warfare, enabling smaller or less technologically advanced countries to level the playing field against more powerful adversaries.

2. Proxy Attacks and Geopolitical Proxy Conflicts: DDoS attacks are frequently employed as covert weapons in proxy conflicts between nations. State-sponsored actors utilize botnets (networks of compromised computers) located in different countries to launch attacks on their targets. By doing so, they can maintain plausible deniability and avoid direct attribution, using these attacks as a way to indirectly exert influence or retaliate against rivals.

3. Information Warfare and Influence Operations: DDoS attacks are often used as elements of information warfare and influence operations. By targeting news websites, social media platforms, or other channels of information dissemination, malicious actors can control narratives, manipulate public opinion, or create chaos during critical moments such as elections or political crises. These attacks can be part of broader disinformation campaigns aimed at destabilizing nations or furthering specific agendas.

4. Hacktivism and Political Activism: DDoS attacks have become a favored tactic of hacktivist groups seeking to promote political or social causes. Such groups may target government agencies, corporations, or other organizations they perceive as oppressive or against their ideals. Through these attacks, they aim to raise awareness, disrupt operations, or simply express dissent. Hacktivist collectives like Anonymous have gained notoriety for their use of DDoS attacks in pursuit of their activism goals.

5. Economic and Financial Warfare: DDoS attacks can also have significant economic consequences. By targeting financial institutions, stock exchanges, or other key players in the global economy, malicious actors can cause disruption, halt trading, or manipulate markets. In an interconnected world, such attacks can have spillover effects on multiple countries, leading to economic instability and impacting geopolitical dynamics.

6. Escalation and Deterrence: DDoS attacks can serve as a means of signaling aggression or sending warnings between nations. They can be used to demonstrate offensive capabilities, test defensive measures, or even escalate tensions in a geopolitical conflict. DDoS attacks may also be employed as a deterrent, showing adversaries the potential consequences they would face if they were to engage in more substantial cyber attacks.

7. Geopolitical Power Shifts: DDoS attacks can be leveraged by emerging powers to challenge the dominance of established geopolitical players. Countries looking to disrupt the status quo may use DDoS attacks as a way to weaken the infrastructure and systems of more influential nations, potentially undermining their global position and influence.

8. International Relations and Norms: The prevalence of DDoS attacks has led to discussions and negotiations around establishing international norms for cyberspace. Governments, organizations, and cybersecurity experts engage in dialogues to define acceptable behavior and rules of engagement in cyberspace, aiming to mitigate the impact of DDoS attacks on geopolitical stability and promote responsible state behavior.

9. Collaboration and Alliances: DDoS attacks have prompted countries to form alliances and collaborate on cybersecurity initiatives. Recognizing the shared threat, nations work together to share information, develop joint defense strategies, and enhance their collective resilience against DDoS attacks. These collaborative efforts contribute to shaping geopolitical relationships and fostering trust among nations.

10. Impact on Infrastructure Development: The risk of DDoS attacks affects the planning and development of critical infrastructure projects. Nations must consider cybersecurity measures as an integral part of infrastructure design to safeguard against potential disruptions. This consideration influences geopolitical dynamics, particularly in regions where infrastructure development is seen as a means of gaining strategic advantage.

11. Regional Instability: DDoS attacks can contribute to regional instability by targeting critical infrastructure and systems. In regions already facing political tensions or conflicts, these attacks can exacerbate the situation, disrupt essential services, and heighten geopolitical risks.

12. State Control and Internet Sovereignty: Some governments use DDoS attacks as a means to control the flow of information within their borders. By targeting websites, social media platforms, or communication networks, they attempt to suppress dissent, limit access to certain content, or maintain strict internet censorship policies. This control over information has implications for domestic politics and international relations.

13. Impact on Global Trade and Supply Chains: DDoS attacks on e-commerce platforms, logistics companies, or trade-related institutions can have profound effects on global trade and supply chains. Disruptions caused by these attacks can lead to economic losses, impact international business relations, and even influence geopolitical alliances and trade patterns.

14. Cybersecurity as a Geopolitical Battleground: DDoS attacks highlight the importance of cybersecurity as a geopolitical battleground. Countries invest in developing advanced defensive capabilities, promoting cybersecurity innovation, and enhancing their resilience against cyber threats. These efforts help shape the power dynamics between nations and determine their standing in the global order.

15. Non-State Actors and Geostrategic Impact: DDoS attacks launched by non-state actors, such as hacktivist groups or cybercriminal organizations, can have unintentional geopolitical consequences. Their activities might trigger diplomatic tensions, strain international relations, or prompt countermeasures by affected countries. The actions of these non-state actors can inadvertently impact broader geopolitical dynamics.

16. Evolution of Cyber Norms and International Law: The prevalence of DDoS attacks pushes for the development of cyber norms, rules, and international laws governing state behavior in cyberspace. There is an ongoing effort to establish a framework that defines acceptable behavior, attribution mechanisms, and consequences for those engaging in malicious cyber activities. The evolution of these norms has geopolitical implications as they shape the boundaries of state conduct in cyberspace.

17. Balancing Security and Privacy: DDoS attacks raise important considerations about the balance between security and privacy. Governments and organizations must navigate the trade-offs between implementing robust cybersecurity measures and protecting individual rights. Finding the right balance may impact political dynamics and public perception of governments' ability to provide security.

As DDoS attacks continue to evolve and increase in scale and sophistication, their impact on geopolitics will likely continue to grow. Understanding and addressing these challenges requires ongoing cooperation, collaboration, and adaptability in the field of cybersecurity and international relations.