Cybercriminals are increasingly using automated tools in their activities, helping them be more efficient and harder to detect, a new report from cloud security firm Barracuda Networks suggests.
The company’s Threat Spotlight report claims there had been a surge in automated and bot-based attacks against web applications, mostly in November and December of 2020.
Of all the attacks the company blocked for its clients at the end of 2020, more than half (54 percent) were done through automated tools. A total of five different attacks stood out, including fuzzing attacks, injection attacks, fake bots, DDoS and bot traffic.
Fuzzing attacks, where criminals use automation to look for exploits, was spotted in every fifth attack (19.5 percent). Injection attacks, where automated tools such as sqlmap are used to try and move into an application, was used in 12 percent of events.
Distributed Denial of Service (DDoS) attacks were “surprisingly prevalent”, the report also says, as nine percent of all samples used this technique.
“It is also important to stay informed about current threats and how they are evolving, so that your business can be defended against them. Over the coming year we can expect automated bot attacks, attacks against APIs, and attacks against software supply chains to develop in quantity and sophistication, especially as these newer attacks have fewer protections and defenses blocking them.”
Just because cybercriminals are deploying new tools, that doesn’t mean they’re stepping away from their old standbys, the report concluded. Large part of the attacks analyzed could be classified as “classic web app attacks”, such as injection attacks and cross-site scripting.
