Summary Report of the 2024 Global Threat Analysis Report

 1. Introduction

The 2024 Global Threat Analysis Report by Radware provides an in-depth look at the evolving landscape of cyber threats, with a particular focus on the impact of artificial intelligence (AI) and large language models (LLMs) like GPT, Gemini, major trends in denial-of-service (DoS) attacks, and the activities of hacktivists. This summary highlights the key findings and presents relevant tables and figures to illustrate these trends.

2. Major Trends in the Threat Landscape

The cybersecurity landscape in 2023 saw significant changes driven by technological advancements and shifts in attack patterns. Key trends include the impact of AI on attack sophistication, the shift to application-level DoS attacks, and the rise of new hacktivist groups.

2.1 Impact of AI (GPT) on Attack Sophistication

AI, particularly GPT and other generative models, has revolutionized the threat landscape. These technologies allow threat actors to develop sophisticated attacks more rapidly. The report highlights that generative AI can discover vulnerabilities, automate spear-phishing campaigns, and create deepfakes, posing significant challenges to cybersecurity defenses.

Generative AI tools enable both legitimate users and malicious actors to boost productivity. However, the lack of guardrails in some open-source models has led to the rise of underground AI services optimized for malicious purposes.

2.2 Shift to Application-level Attacks

In 2023, there was a notable shift in DoS attack patterns towards application-level targets, particularly the Domain Name System (DNS). Attackers have increasingly targeted DNS services with various types of floods and amplification attacks, aiming to disrupt online services by overwhelming DNS servers.

Table 1: Types of DNS Attacks

Attack Type	Description
DNS Amplification Attack	Reflection-based volumetric DDoS using large DNS response data
DNS Flood Attack	Overloads DNS server with high volume of requests
DNS NXDOMAIN Attack	Floods DNS server with requests for non-existent domains
Phantom Domain Attack	Sends requests to nonresponsive phantom domains to exhaust server resources
Pseudo Random Subdomain Attack	Overloads DNS server with requests for random subdomains of a valid domain

These attacks exploit different aspects of the DNS protocol, making them difficult to defend against and underscoring the need for robust DNS security measures.

3. Denial-of-Service Attack Activity

The report details a range of DoS attack activities, highlighting the prevalence of various attack vectors and their impacts.

3.1 Network-level Attacks

Network-level attacks, including SYN floods and ICMP floods, continue to be a significant threat. The report shows a high volume of DoS events, with a marked increase in intrusion attempts leveraging known vulnerabilities.

Table 2: Top Attack Vectors by Packets

Attack Vector	Percentage of Total Packets
DNS-A Flood	44.9%
SYN Flood	7.28%
Other	4.36%
FRAG Flood	2.99%
SYN-ACK Flood	1.74%

The data indicates that denial-of-service events dominate the attack volume, while network intrusions and active attacker feed events contribute significantly to the total number of incidents.

3.2 Application-level Attacks

Application-level attacks, particularly those targeting VoIP infrastructures, have become more common. The report discusses how SIP services have been frequent targets, especially since the pandemic increased reliance on remote communication tools.

4. Hacktivist Activity

2023 saw the emergence of new hacktivist groups driven by geopolitical and social events. Pro-Russian and pro-Ukrainian hacktivists were particularly active alongside groups motivated by religious and other ideological conflicts.

Table 3: Notable Hacktivist Groups and Activities

Hacktivist Group	Activity Description
NoName057(16)	Pro-Russian patriotic activities
Cyber Army of Russia	Engaged in pro-Russian patriotic hacking
Anonymous Sudan	Involved in various cyber campaigns
Killnet	Known for high-profile attacks, lost its iconic leader in 2023
Other new groups	Emerged following significant global events

These groups have leveraged platforms like Telegram to coordinate and amplify their activities, increasing their visibility and impact on the global threat landscape.

Fig: Global Threat Report 2024 Summary

5. Conclusion

The 2024 Global Threat Analysis Report highlights the dynamic nature of the cybersecurity landscape, driven by technological advancements and evolving attack strategies. The rise of generative AI, the shift to application-level DoS attacks, and the increasing activity of hacktivist groups underscores the need for robust, adaptive cybersecurity measures.