Cyber Threat Index

A Thailand-based travel company experienced a sharp surge in business logic abuse against its public API, highlighting how economically motivated automation can rapidly escalate. Beginning mid-month, attackers launched large-scale automated scraping of pricing and availability endpoints, likely to support competitive intelligence, resale, or pricing arbitrage, driving traffic to peaks of approximately 70 million requests per day over a four-day period- over 500% higher than average daily traffic. After the initial spike, activity declined but stabilized at a still-elevated baseline of roughly 10 million daily requests, consistent with attackers shifting from aggressive discovery to persistent data harvesting. The traffic was overwhelmingly sourced from Singapore-based IP addresses, suggesting centralized, cloud-hosted automation rather than organic customer demand, and reinforcing how travel platforms remain high-value targets for business logic attacks focused on monetization rather than disruption.

A US-based sports retail site was subjected to sustained API-driven automation throughout January, indicating attacker interest in abusing high-risk application functionality rather than generating disruptive traffic. The activity averaged 1.5 million requests per day and was attributed to moderate and advanced bots, consistent with controlled tooling designed to probe application behavior and bypass validation controls. While the campaign relied on just 17 IP addresses over the month, the narrow infrastructure footprint suggests deliberate, low-and-slow testing rather than broad scanning. The focus on file-handling logic indicates attackers were likely probing upload workflows to identify opportunities for malicious file delivery, content validation bypass, or the introduction of payloads that could later support fraud, defacement, or deeper application compromise. This pattern reflects reconnaissance-driven abuse, where attackers methodically test upload and processing logic before escalating to more impactful exploitation.

Take action:
Imperva API security provides comprehensive protection for common and multi-vector attacks.

A Turkish cybersecurity company was hit with a high-intensity application-layer DDoS attack in early January, reaching nearly 10 million requests per second, underscoring how a small amount of well-engineered infrastructure can generate outsized impact. Despite the extreme request rate, the activity originated from just 54 distinct IP addresses, indicating the use of high-capacity nodes or amplification through efficient request generation, rather than a traditional botnet. Attackers attempted to exploit React2Shell (CVE-2025-55182), among other vulnerabilities. Targeting a cybersecurity vendor suggests motivations beyond disruption alone, including stress-testing defensive controls, probing rate-limiting thresholds, or attempting to degrade trust and availability during critical operations. The attack’s concentrated nature and brief but intense profile are consistent with attackers seeking to validate tooling effectiveness or demonstrate capability, rather than sustain prolonged downtime.

A US-based entertainment site experienced two large-scale account takeover (ATO) attempts in January, both driven by credential stuffing, highlighting the stark difference in attacker capability. The first campaign peaked at 4.7 million malicious login requests and was carried out by more advanced bots impersonating legitimate browsers, suggesting an effort to bypass bot detection and rate-limiting controls while validating stolen credential sets. This attack originated from a relatively small pool of 43 US-based IP addresses, consistent with high-throughput, carefully managed automation. The second attack, which reached 3.4 million login attempts, shifted to simpler bot infrastructure distributed across nearly 15,000 US-based IPs, indicating a broader, noisier approach aimed at maximizing coverage after initial probing. The first attack is far more sophisticated, able to create massive attack numbers with a small number of IPs. On the other hand, the second attack is comparatively less advanced, requiring thousands of IPs to create a smaller attack.

Take action:
Imperva Account Takeover prevention uses multi-layered detection to block fraud.