DDoS Botnet Operators Shift to Cryptocurrency Mining

According to data from Kaspersky Lab, the number of DDoS attacks in the fourth quarter of 2020 increased by 10% compared to the same period in 2019, but decreased by 31% compared to the third quarter of 2020. This means the market decline that began in the spring of last year is still ongoing.

Researchers believe that the sharp growth of the cryptocurrency market may have influenced the decrease in DDoS attacks at the end of 2020. It appears that many botnet operators redirected some of their resources to cryptocurrency mining, allowing infected devices to generate profit. This assumption is supported by statistics from the Kaspersky Security Network. Throughout 2019 and early 2020, the number of cryptominers was falling, but starting in August 2020, it began to rise sharply and reached a plateau in the fourth quarter.

The decline was mainly due to a reduction in easily organized attacks, while the share of more sophisticated “smart” DDoS attacks decreased only slightly. The likely reason is that as the cost of such services rises, amateurs—such as students, petty troublemakers, and impulsive individuals without serious motives—are the first to drop out. However, professional interests remain relevant, especially during the holiday and sales-rich fourth quarter, so professionals continue to order and organize attacks.

Additionally, from October to December 2020, incidents involving educational institutions continued to be reported. Several schools in Massachusetts and Laurentian University in Canada, for example, experienced such issues. Popular gaming platforms also suffered from junk traffic in the final quarter of the year.

Interestingly, the most active day of the quarter for DDoS attacks was December 31, 2020, when 1,349 attacks were recorded in a single day.

“Two opposing trends are currently influencing the DDoS attack market. On one hand, this tool remains in demand among cybercriminals: the stability of online resources is crucial for many important processes, including business and education. At the same time, the rising value of cryptocurrencies makes mining attacks more profitable. Since current fluctuations are mainly tied to cryptocurrency price dynamics, we do not expect an explosive growth or decline in the DDoS market in the near future,” commented Alexey Kiselev, project manager for Kaspersky DDoS Protection.