Russian banks have started preparing for carpet DDoS attacks

This season’s clients were mainly large and medium-sized banks, which were looking for an opportunity to better deal with carpet DDoS attacks like in the summer of 2024, the senior manager noted.

IT integrator Telecom Exchange recorded in the summer of 2024 increased interest from banks in testing protection solutions against DDoS attacks to determine their ability to withstand “carpets”, Telecom Exchange sales director Vasily Polkin told the publication .

During that period, up to two-thirds of all cybersecurity calls from banks were directly or indirectly related to these types of attacks: financial institutions wanted to strengthen their existing protection or change cybersecurity service providers. Demand for these types of solutions did not slow down in the fall, Polkin noted.

The main systems that banks want to protect from cyberattacks are mobile applications and online banking, since they are the main way in which customers interact with the bank. Their lack of availability disrupts customer service processes and undermines trust in the organization and its services, said Stanislav Shilov, director of product development at IT developer BSS.

As part of the tests, special cybersecurity laboratories simulate various attacks, including multi-vector DDoS, on banks’ DNS servers, and also try to penetrate the system and create scenarios for possible incidents. The tests are carried out by both automated systems and cybersecurity specialists: the results of the checks allow banks to verify the reliability of their own security systems, provide detailed reports and raw statistics.

The number of cyberattacks on Russian banks during the 10 months of 2024 doubled last year’s figures, RED Security SOC analysts found. The financial sector was second on the list of industries that suffered the highest risk hacking attacks.

Previously, Vedomosti reported that the number of leaks of corporate accounts with usernames and passwords in 2024 reached 16 thousand, 60% more than last year. In nearly half of the successful attacks, hackers gained access to internal business systems using infected software sent via phishing emails, with insurance, healthcare and e-commerce services hit hardest.