New DDoS Attacks Use Far Fewer Infected Hosts, Target Education

Akamai Technologies has identified a new attack method generating extremely large distributed denial of service (DDoS) attacks against educational institutions and other types of organizations but without the millions of infected hosts typically seen in these scenarios. In a threat advisory recently published by the content delivery network company's security intelligence response team, researchers described a reflection and amplification method that can produce "significant attack bandwidth" through "significantly fewer hosts." What's required are open ports allowing LDAP traffic.

The company's security experts have detected and mitigated a total of 50 Connection-less Lightweight Directory Access Protocol (CLDAP) reflection attacks. CLDAP was intended as an "efficient alternative to LDAP queries done over Transmission Control Protocol (TCP).

Most of the attacks seen in the wild used CLDAP reflection exclusively. Twice, education has been the target. However, the primary victims have been in the software and technology industry, where 21 attacks have taken place, and the gaming segment, which has had 15 attacks.

The largest of the attacks hit its target with a peak bandwidth of 24 gigabits per second and a top count of packets per second of 2 million. The source port was 386, the port used by Lightweight Directory Access Protocol (LDAP).

According to the report, signatures of the attack suggest that it's "capable of impressive amplification." For example, Akamai security people obtained sample malicious LDAP reflection queries that had a payload of only 52 bytes. Yet the attack data payload was 3,662 bytes, meaning that the amplification factor was 73. More typically, the average amplification rate was 57, according to the researchers.

The attacks are launched using "attack scripts," usually written in C and with only slight variations from one vector to another. When the script is run, the target IP becomes the source of all the 52-byte query payloads. These are then sent rapidly to every server in the supplied reflector list. From there, the CLDAP servers do as they're designed and reply to the query. As a result, the report described, "the target of this attack must deal with a flood of unsolicited CLDAP responses."

The attack is "fueled" by the number of servers on the internet with port 389 open and listening. Once a server has been identified as a viable source, it's added to the list of reflectors. The best mitigation, suggested the report, is to filter the port in question. "Ingress filtering of the CLDAP port from the internet will prevent discovery and subsequent abuse of this service," the report noted. Another option is to apply rules, which won't stop the outbreak, but will alert system administers when an attempt is made to use the systems as part of a reflection attack.

The report, "CLDAP Reflection DDoS" is available from Akamai's dropbox account here.

About the Author

Dian Schaffhauser is a former senior contributing editor for 1105 Media's education publications THE Journal, Campus Technology and Spaces4Learning.

Featured

  • mathematical formulas

    McGraw Hill Launches AI-Powered ALEKS for Calculus

    McGraw Hill has added ALEKS for Calculus to its lineup of ALEKS digital learning products, bringing AI-powered personalized learning support to the calculus classroom.

  • abstract pattern of cybersecurity, ai and cloud imagery

    Report Identifies Malicious Use of AI in Cloud-Based Cyber Threats

    A recent report from OpenAI identifies the misuse of artificial intelligence in cybercrime, social engineering, and influence operations, particularly those targeting or operating through cloud infrastructure. In "Disrupting Malicious Uses of AI: June 2025," the company outlines how threat actors are weaponizing large language models for malicious ends — and how OpenAI is pushing back.

  • Digital clouds with data points and network connections

    Microsoft's Windows 365 Cloud Apps Available in Public Preview

    Microsoft has announced that its Windows 365 Cloud Apps are now available in public preview. This allows IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.

  • teen studying with smartphone and laptop

    OpenAI Developing Teen Version of ChatGPT with Parental Controls

    OpenAI has announced it is developing a separate version of ChatGPT for teenagers and will use an age-prediction system to steer users under 18 away from the standard product, as U.S. lawmakers and regulators intensify scrutiny of chatbot risks to minors.