Cyber Threat Index Score by Country
Cyber Threat Index Score by Industry
Country
Insights and Recommendations
Imperva’s cloud networks, the same network that gathers the data behind our Cyber Threat Index, also powers the suite of products that protects our customers from those attacks every day. Start by reading our expert analysis on this month’s most significant insights, and then click to take action below.
This month, Israeli financial institutions and services experienced a significant uptick in distributed denial of service (DDoS) attacks. One financial services site faced its largest application-layer DDoS attack to date, enduring an hour-long onslaught that peaked at 3.5 million requests per second (RPS), indicative of a well-coordinated effort involving a vast botnet of over 13,000 unique IP addresses. Across multiple incidents, over 3200 IPs were identified as overlapping among the attacks, strongly suggesting a coordinated campaign against these sites. These attacks, targeting sites that have been repeatedly attacked throughout the year, highlight the persistent and evolving threat of politically or financially motivated cyber aggression towards Israeli financial sectors.
Take action:
Imperva DDoS Protection secures all your assets at the edge for uninterrupted operation.
This month, an Italian telecommunications site was subjected to an aggressive account takeover (ATO) campaign, witnessing nearly 8 million attempted logins in a sophisticated brute force attack lasting almost 24 hours. Remarkably, the attack came exclusively from within Italy, utilizing bots for the vast majority of login attempts. This localized nature of the attack suggests a highly targeted approach, possibly indicating the presence of a formidable botnet operation within the country. Notably, less than 10% of the credentials attempted were from previously leaked datasets, implying that the attackers were relying heavily on generating combinations to breach accounts. This incident highlights the escalating challenge of securing digital identities against the backdrop of increasingly automated and localized cyber threats.
Take action:
Imperva Account Takeover prevention uses multi-layered detection to block fraud.
This month, a prominent US-based entertainment website experienced severe remote code execution (RCE) attacks, attempting to exploit several vulnerabilities including CVE-2022-21371. With the attacks generating over 10 million requests per day, the scale of this attack is noteworthy. The offensive was launched from IP addresses–primarily leveraging tools written in Go– located within the US, suggesting the possible use of a regional botnet or a deliberate strategy to obscure the attackers' true geographical origins or bypass georestrictions. This incident not only underscores the vulnerability of entertainment platforms to sophisticated cyberattacks, but also highlights the complexity of attributing such attacks in an increasingly interconnected digital landscape.
Take action:
See how Imperva Web Application Firewall can help you defend against attacks like RCE..
Following this year’s trend of increasing DDoS attacks, a Romanian retail website was the target of an application-layer distributed denial of service (DDoS) attack, peaking at just over 4 million requests per second (RPS). In addition to being this year's second-largest DDoS attack, this is the largest attack we’ve ever seen on Romania, up from a previous average of 27,000 RPS. Originating from approximately 2,000 IP addresses, with a notable concentration in both Romania and China, this incident not only highlights the global scale and coordination behind such cyberattacks but also raises concerns about the potential involvement of international cybercriminal networks. This attack underscores the critical need for robust cybersecurity defenses in the retail sector, which is increasingly becoming a focal point for high-scale DDoS campaigns.
Take action:
Imperva DDoS Protection secures all your assets at the edge for uninterrupted operation.
Application Security Threats
Understand how applications are attacked globally. Learn the types of attacks and the vulnerabilities exploited.
Application Security Highlights
With visibility into global web application traffic from different industries, the Cyber Threat Index is a comprehensive look at application security.
Total Number of Requests Analyzed
Total Number of Application Attacks Blocked
Origin of Web Threats
This map reflects the relative amount of attacks per country, after normalizing the number of attacks with legitimate traffic. Hover mouse over the countries to see data.
Country vs Country Heatmap
This heatmap shows attacks where countries are the source (attackers) or destination (attacked) of application security attacks. The number represents a relative, normalized value.
Cyber Attack Types
Breakdown of attack attempts seen in our network, split by attack types.
Cyber Attacks by Source
Breakdown of attack attempts seen in our network, split by the source of the attacking traffic.
Automated vs Human Attacks
Shows the proportion of bot and human traffic identified as performing attacks within all observed traffic.
Attacks Observed by Tool Used
Shows the breakdown of attacks in our network by the type of tool used by attackers.
Vulnerabilities by Severity
Shows the number of disclosed vulnerabilities for every day of the month. These vulnerabilities are separated by severity. Includes both CVE (Common Vulnerabilities & Exposure) and ‘Non-CVEs’.
Vulnerabilities by ‘Exploitability’
Breakdown of vulnerabilities disclosed by the “exploitability” (e.g. whether there is a published exploit) of the disclosed vulnerability.
Vulnerabilities by Attack Type
Shows the breakdown of attack types for the published vulnerabilities.
Data Security Threats
Understand how databases are attacked and make sense of the vulnerabilities on different platforms.
Vulnerabilities by Severity
In the following chart you can see the disclosed vulnerabilities for every day of the month. We separate them by their severity. This includes both CVE (Common Vulnerabilities & Exposure) and ‘Non-CVEs’.
Low Severity
Vulnerabilities
Medium Severity
Vulnerabilities
HIGH Severity
Vulnerabilities
DDoS Threats
Distributed denial of service (DDoS) attacks take a business offline. Understand which industries and countries suffer the most and the different types of DDoS attacks. Learn about the duration, size, and volume of DDoS attacks.
DDoS Attacks Highlights
Understand the duration of the longest attack. Know the size and volume of the largest DDoS attacks. Learn more about DDoS here.
Longest DDoS
attack
Largest Web Application
DDoS attack
Largest Bandwidth Network
Layer DDoS Attack
Highest Volume Network
Layer DDoS Attack
Application Layer DDoS Attack
Shows the volume of Application Layer attacks for each day of the month by the maximum total requests per second (RPS) blocked by our DDoS mitigation service.
DDoS Attacks by Attacked Country
Breakdown of DDoS attacks by the attacked country.
DDoS Attacks by Attacked Industry
Breakdown of DDoS attacks by the attacked industry.
Network Layer DDoS Attack
Network layer attacks look to overwhelm the target by exhausting the available bandwidth. Shows the attacks by their bandwidth and by volume.
Network Layer Attack Volume (Gbps) by Vector
Breakdown of bandwidth volume (Gigabits per second) by the vector used in network layer DDoS attacks.
Network Layer Attack Rates (Mpps) by Vector
Breakdown of attack rates (Mega packets per second) by the vector used in network layer DDoS attacks.
Take The Next Step
Our insights and recommendations are just the starting point. With Imperva’s dedicated team by your side, and access to our cloud network-powered suite of products, you can get protected, quicker.
Get in TouchMedia Inquiries
Every month we update the Cyber Threat Index with the latest data and charts. Please contact us for additional insight or to interview the threat researchers from the Imperva Research Lab.
Contact UsWhat is the Cyber Threat Index?
The Cyber Threat Index is a monthly measurement and analysis of the global cyber threat landscape across data and applications.
The Cyber Threat Index provides an easy-to-understand score to track cyber threat level consistently over time, as well as observe trends. The data is (when applicable) also analyzed by industry and by country, to provide further analytics and insights.
The Cyber Threat Index is calculated using data gathered from all Imperva sensors across the world including over:
- Over 25 monthly PBs (Peta Bytes1015) of network traffic passed through our CDN
- 30 billions (109) of monthly Web application attacks, across 1 trillion (10¹²) of HTTP requests analyzed by our Web Application Firewall service (Cloud WAF)
- Hundreds of monthly application and database vulnerabilities, as processed by our security intelligence aggregation from multiple sources
Viewers of the global Cyber Threat Index can dive deeper into the score & drill-down for individual industries and countries, and also view historic Index scores.
On a monthly basis, our security experts are analyzing the data, to create insights about events and trends in data & application security based on the data we see. When applicable, we may also suggest recommendations for enhancing the security posture against the threats we see.
How is the index calculated?
The index is based on a number of ingredients: network traffic, attack traffic and vulnerabilities.
We store attack data, as well as statistics about the network traffic we see from our Cloud WAF. This data is sent from our Cloud WAF proxies to our data warehouse, where it is enriched & aggregated.
On a daily basis, we run analytics on the data we collect, to calculate a daily risk score per site, per industry & per country.
Vulnerabilities
When calculating the vulnerabilities’ risk, our assessment is that:
- The more severe the vulnerability – the higher the risk (Impact can be larger, for example: taking over a server vs disclosing system information)
- The more recent the vulnerability – the higher the risk (The assumption is that patching of systems takes time, therefore there will be more vulnerable systems accessible)
- If there is a public exploit, the risk is higher as more attackers has the ability to exploit the vulnerability, and the more wide-spread it is the higher the risk.
DDoS Attacks
We store statistics on both network DDoS attacks and application DDoS attacks.
Network DDoS attack statistics include details about the duration of the attack, the volume of the attacks, number of sources and their proportion in the attack, different ports and methods (e.g. SYN flood, amplification etc.). These statistics are calculated and stored for attacks both in terms of packet per second and in terms of bytes per second.
Application DDoS (Layer 7 DDoS attacks) statistics include information about the duration of the attack, the volume of the attack, the tools that were used and the different countries it originated from in terms of requests per second.
We normalize all DDoS attacks statistics against the statistics we have about legitimate traffic, to prevent bias for increased/decreased amount of assets we protect (Globally or for a certain industry/country).
Application Security Attacks (As seen in the wild)
At first, instead of dealing with a huge amount of daily attacking requests, we aggregate them into attacks (Each attack can have a very large number of HTTP requests as part of it). For each attack, we check:
- The highest risk level of triggered rule within that attack (For example: an SQL Injection attack has more weight than an information disclosure attack).
- The higher the intensity of the attack, the higher the risk.
- The newer the mitigation, the riskier the attack (We constantly add mitigations to our cloud WAF, and the assumption is that newer attacks has more success ratio than older ones).
For the analytics and insights we provide, we also enrich the data, for example:
- Adding target industry classification for the applications being attacked.
- Adding source & target countries.
- Adding source network types (For example: public cloud, TOR, etc).
The risk is then calculated by removing the lowest-risk attacks, as they’re meaningless in terms of added risk, and determining the risk is done by normalizing attack traffic against normal traffic. The logic to this normalization is that we don’t want the index to be affected by increased/decreased traffic (For example: if we have 20% more traffic due to new customers in a certain month, we don’t want it to affect the risk index).
