Malicious DDoS Attacks Rise 150% in 2022 According to New Report

Radware, a provider of cyber security and application delivery solutions, released its 2022 Global Threat Analysis Report. The full-year report leverages intelligence provided by network and application attack activity sourced from Radware’s Cloud and Managed Services, Global Deception Network and threat research team.

“‘More’ is the operative word for the global threat landscape in 2022. Compared to 2021, there were not only more DDoS attacks in terms of sheer number, but they were also more powerful, frequent and complex, spanning more attack vectors,” said Pascal Geenens, director of threat intelligence for Radware. “The surge can be attributed in part to digitalization, the war in Ukraine, and a long-tail of new vulnerabilities and exposed services driven by work-from-home remote access during Covid. The ongoing tensions between major world powers have also led to a rise in state-sponsored cyberattacks and espionage activities.”

Global Attack Trends: The Unrelenting Rise of DDoS

The global DDoS landscape is rapidly evolving. In 2022, DDoS attack profiles were redefined by gains in number, frequency, volume, power, duration and complexity.

  • Number of attacks: In 2022, the number of DDoS attacks grew 150% on a global basis compared to the previous year. The number of attacks in the Americas rose even faster, increasing 212% compared to 2021. More than half of the attacks were aimed at organizations in EMEA. The Americas accounted for 35% of the attacks while 7% of the attacks targeted APAC organizations.
  • Attack frequency: The frequency of DDoS attacks also saw a significant and concerning uptick. Globally, organizations mitigated an average of 29.3 attacks per day during the fourth quarter of 2022, 3.5 times more compared to 8.4 attacks per day at the end of 2021. Attacks in EMEA grew even faster than the global average and outpaced both the Americas and APAC. Organizations in EMEA averaged 45 attacks per day in the fourth quarter of 2022, four-times more compared to 11.3 attacks per day during the same period in 2021.
  • Attack volume: While the total global attack volume recorded in 2022 was 4.44PB, an increase of 32% compared to 2021, the Americas faced the heftiest increases. Last year, attack volumes in the Americas outpaced global volumes, growing 110% compared to 2021. While EMEA topped the Americas in frequency of attacks, it saw total attack volume decline in 2022, decreasing by 44% compared to the previous year.
  • Attack power: Globally, the largest recorded attack in 2022 was 1.46Tbps, which is 2.8 times larger than the largest attack recorded in 2021.
  • Attack duration: The longest attacks in 2022 ranged between 100 and 250Gbps on a global basis, where on average the attacks lasted 66 hours or 2.75 days.
  • Attack complexity: DDoS attacks continue to increase in complexity. Attackers typically leverage multiple and dissimilar vectors to increase the impact and make attack mitigation harder. On a global basis in 2022, attacks above 1Gbps on average had more than two dissimilar attack vectors per attack, which doubled in complexity for attacks above 10Gbps. Attacks above 100Gbps had on average more than nine dissimilar attack vectors with the most complex attacks leveraging 38 dissimilar attack vectors.

“In 2023, the democratization of DDoS and patriotic hacktivism will continue to drive an increase in smaller, more frequent attacks – a trend we are already seeing in the increased frequency of lower volume attacks in EMEA. At the same time, expect the cybercrime underground to become even better organized and funded in its pursuit of hard-hitting attacks,” said Geenens. “Attackers are always looking for new more sophisticated ways to advance their cyber agendas. As a result, organizations find themselves in an escalating state of risk, trying to defend themselves against next-generation threats.”

Most Attacked Industries

On a global basis, finance was the most attacked industry in 2022, with 53% of the overall attack activity, followed by technology (20%) and healthcare (11%).

Even on a geographic distribution, finance and technology were among the industries shouldering the brunt of the DDoS activity.

  • In America, finance represented 32% of the attack activity, followed by healthcare (24%) and technology (17%).
  • In EMEA, finance (71%) also topped the list as the most-attacked industry, followed by technology (16%) and government (4%).
  • In APAC, technology was the most attacked industry, with 70% of the attack activity, followed by finance (9%) and government (8%).

Web Application, API Attacks

Web application and API attacks grew exponentially in 2022.

  • Web application and API attacks increased 128% year over year, significantly out pacing the 88% increase in attacks between 2020 and 2021.
  • Predictable resource location attacks accounted for almost half of the attack activity. Together, code injection (14%) and SQL injection (11%) attacks represented another quarter of the web application attacks.
  • The most attacked industries were retail and wholesale trade (25%), followed by high-tech (20%), and carriers (15%), together accounting for 60% of blocked web application attacks.

Featured

  • AI Is Now the Leading Cybersecurity Concern for Security, IT Leaders

    Arctic Wolf recently published findings from its State of Cybersecurity: 2025 Trends Report, offering insights from a global survey of more than 1,200 senior IT and cybersecurity decision-makers across 15 countries. Conducted by Sapio Research, the report captures the realities, risks, and readiness strategies shaping the modern security landscape. Read Now

  • Analysis of AI Tools Shows 85 Percent Have Been Breached

    AI tools are becoming essential to modern work, but their fast, unmonitored adoption is creating a new kind of security risk. Recent surveys reveal a clear trend – employees are rapidly adopting consumer-facing AI tools without employer approval, IT oversight, or any clear security policies. According to Cybernews Business Digital Index, nearly 90% of analyzed AI tools have been exposed to data breaches, putting businesses at severe risk. Read Now

  • Software Vulnerabilities Surged 61 Percent in 2024, According to New Report

    Action1, a provider of autonomous endpoint management (AEM) solutions, today released its 2025 Software Vulnerability Ratings Report, revealing a 61% year-over-year surge in discovered software vulnerabilities and a 96% spike in exploited vulnerabilities throughout 2024, amid an increasingly aggressive threat landscape. Read Now

  • Motorola Solutions Named Official Safety Technology Supplier of the Ryder Cup through 2027

    Motorola Solutions has today been named the Official Safety Technology Supplier of the 2025 and 2027 Ryder Cup, professional golf’s renowned biennial team competition between the United States and Europe. Read Now

  • Evolving Cybersecurity Strategies

    Organizations are increasingly turning their attention to human-focused security approaches, as two out of three (68%) cybersecurity incidents involve people. Threat actors are shifting from targeting networks and systems to hacking humans via social engineering methods, living off human errors as their most prevalent attack vector. Whether manipulated or not, human cyber behavior is leveraged to gain backdoor access into systems. This mainly results from a lack of employee training and awareness about evolving attack techniques employed by malign actors. Read Now

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.