Significant Increase in Malicious Traffic Successfully Mitigated
Summary
WAYSCloud detected and mitigated 406,171 attack attempts from 205,461 unique sources within a one-hour period, consistent with a coordinated, botnet-like distributed denial-of-service (DDoS) attack, followed by a renewed wave in the second hour.
The exceptional traffic volume directed at our edge layer caused temporary degraded responsiveness in the customer dashboard and APIs. Traffic has since fallen considerably and services are returning to normal. There is no indication of any security breach, customer data exposure or infrastructure compromise, and underlying customer workloads remained unaffected.
What Happened
Our monitoring systems detected a substantial increase in hostile and unwanted Internet traffic directed at WAYSCloud infrastructure.
While public-facing cloud services continuously receive automated scans and abuse attempts, the observed activity represents a notable deviation from our normal baseline and warrants public disclosure in the interest of transparency.
During the observed one-hour period:
- 406,171 attack and abuse attempts detected
- 205,461 unique source addresses observed
- Activity originating from 211 countries and territories
- No confirmed impact on customer services or availability
The activity consists primarily of automated scanning, probing, credential attacks and other forms of abusive traffic targeting Internet-facing systems.
Based on the volume, distribution and rate of activity, our current assessment is that the traffic appears coordinated or botnet-like in nature. No attribution has been made, and investigations remain ongoing.
Importantly, the observed traffic has been detected, classified and mitigated by multiple defensive layers before reaching critical systems.
Impact
At this time:
- No customer accounts have been compromised
- No customer data exposure has been identified
- No security breach or infrastructure compromise has been identified
- Core infrastructure remained operational throughout the event
- Detection and mitigation systems performed as expected
At its peak, the exceptional traffic volume directed at our edge layer caused temporary degraded responsiveness (slowness) in the customer dashboard and APIs. As the attack has subsided, this latency is easing and services are returning to normal. Underlying customer workloads and data remained unaffected throughout.
Actions Taken
Upon detection of the increased activity, WAYSCloud initiated enhanced monitoring across network, application and authentication layers.
Additional telemetry collection and analysis have been enabled to better understand the nature and scope of the activity, while existing mitigation controls continue operating normally.
The observed event volume is significantly above our typical baseline. However, the activity is currently being successfully identified and filtered before it can affect customer-facing services.
As a result of the unusually high event volume, certain non-critical visualisation and reporting components may experience delayed updates while processing telemetry data. This does not affect detection, mitigation, monitoring or protection capabilities.
Current Status
This incident is resolved. Traffic has returned to normal baseline levels and all customer-facing services, including the customer dashboard and APIs, are operating normally.
No security breach or customer data exposure occurred at any point. WAYSCloud will continue routine monitoring of the service.