📋 Tender Overview
In the third quarter of 2024, Rostelecom specialists repelled and investigated 11 targeted attacks on infrastructure, more than half of which were initiated by pro-Ukrainian hacker groups. The attackers exploited vulnerabilities in external online resources, and also tracked user errors and violations of internal security rules by individual employees. In total, more than 1,300 attacks were repelled during this period, including phishing, DDoS and other types of threats.
The most popular among attackers were DDoS attacks aimed at the infrastructure that provides communication services to mass-market clients (B2C). The most powerful of them, UDP-Flood, reached a peak of 5 Tbps or 440 million packets per second.
Cybercriminals are increasingly less likely to resort to well-known hacker tools, preferring to use standard operating system tools to minimize their presence in the infrastructure. At the same time, there is an increase in attacks on supply chains, which significantly complicates protection due to the multi-level structure, differences in the level of protection among suppliers, and the difficulty of identifying vulnerabilities at each stage of logistics. Rostelecom is actively working to increase awareness of cyber threats and minimize risks associated with the human factor, since administrative errors and management shortcomings play a significant role in the vulnerability of the infrastructure.
Alexey Chugunov, Vice President for Development and Information Security at Rostelecom:
At Rostelecom, we face new cyber threats every day, and each attack on our infrastructure varies in complexity and duration. Our ecosystem includes many products that are of increased interest to attackers. To effectively protect against cyber threats, it is important to regularly train employees, monitor the infrastructure perimeter, keep IT systems up to date through inventory and software updates, as well as implement and effectively use multi-level protection systems, monitoring tools, and response to information security incidents. Regular data backups and cyber drills will help minimize losses in the event of an attack. UDP flood is a type of DDoS attack in which an attacker sends a lot of useless messages to a server to overload it and make it work slower or shut down.
