I remember the incident like it was yesterday, even though it was over 10 years ago. During an incident response engagement for an e-commerce merchant, we discovered a critical data breach originating within their online shopping cart application. The threat actors escalated their privileges and escaped from the application environment directly to the management plane, where they began exfiltrating sensitive customer data.
Just as their incident response team initiated containment procedures to secure the system and stop the data drain, the merchant's infrastructure was hit by a targeted Distributed Denial of Service (DDoS) attack. This sudden onslaught was a deliberate, tactical move designed to saturate network bandwidth, overwhelm their team, and delay containment efforts.
Marketing people love to talk about how DDoS is a distraction or a smokescreen to cover up other attacks. This has been written so many times that LLMs will tell you the same. And I think that description is not necessarily false, but that it is entirely too shallow.
The Impact of DDoS Attacks In Conjuction with Other Attacks
Instead, we have to consider that some DDoS attacks are deliberate, calculated measures, ie, what we call "Tactics, Techniques, and Procedures" (TTPs) in Cyber Threat Intelligence (CTI) taken by attackers to achieve goals that extend well beyond simply causing an outage of networks, services, and applications. In these cases, the disruption itself is not the end goal. Instead, it is a means to an end, serving a broader, more strategic purpose within a larger attack campaign.
Slowing Down Incident Response
As mentioned earlier, a DDoS attack can immediately overload SOC, NOC, and systems management staff: stretching resources thin and forcing responders to prioritize the flood of incoming alerts over other ongoing threats. This gives the attacker more "dwell time" on compromised systems, during which they can operate with less scrutiny and interference. That additional time and reduced visibility can be used to establish additional command-and-control mechanisms, making it harder to fully eradicate the attacker once the DDoS subsides, or to exfiltrate larger volumes of data before the breach is even detected.
Exhausting SOC and Systems Management Staff
This challenge comes down to the depth of an organization's incident response "bench." Most incident responders can only effectively manage an active incident for 4-6 hours before fatigue sets in and their performance begins to decline. Well-prepared organizations account for this by rotating response staff once they reach that threshold. However, a long-running incident, such as a continuous DDoS campaign lasting several weeks, places significant strain on this rotation model. As the incident drags on, the pool of available, rested responders shrinks, leaving organizations increasingly reliant on fatigued staff who are less equipped to make sound decisions under pressure. This gradual depletion of human resources can weaken an organization's overall incident response capability precisely when it is needed most.
Flooding Log Pipelines with Events
When network devices or application servers are overwhelmed with traffic, they generate an unusually high volume of logs in a very short period of time. These logs can quickly fill up local storage on the affected devices, as well as the drives on centralized log management or SIEM systems. In some cases, the sheer volume of network traffic caused by a DDoS attack can prevent logs from being transmitted to log collectors altogether. The result is slower log ingestion, gaps in visibility into what is happening across the environment, and, in more severe scenarios, the potential for log management systems to crash entirely. This loss of logging fidelity makes it significantly harder for security teams to monitor the attack, understand its scope, and coordinate an effective response in real time. This degradation in the logging pipeline also makes it more difficult to detect and monitor other types of security incidents.
Causing Network Protections to Fail Open
Many network boundary controls, such as firewalls, intrusion detection systems (IDS), and similar security appliances, are designed to prioritize availability over security when overwhelmed. When flooded with excessive network traffic, these systems may begin dropping events or default to a fail-open state, meaning they stop enforcing security policies and allow all traffic to pass through unchecked. This effectively renders critical layers of network defense inactive at the exact moment they are needed most.
Disrupting Cyber Threat Intelligence Feeds
Many technical controls consume Cyber Threat Intelligence (CTI) feeds from vendors or the incident response community. These feeds are integral to organizations' cybersecurity frameworks, as they provide real-time updates on known threats, vulnerabilities, and attack patterns. By targeting or turning off these intelligence sources, adversaries can delay the dissemination of critical security updates and patches, thereby increasing their window of opportunity to exploit vulnerabilities. Such disruptions can also undermine confidence in cybersecurity tools that rely on automated intelligence, leaving organizations more susceptible to advanced attacks and reducing their ability to respond promptly to emerging threats.
Compelling the Target to Turn off its Application Protections
Web application firewalls (WAFs) and similar application-layer security controls are resource-intensive by design, requiring significant CPU and RAM to inspect and evaluate each incoming HTTP request. When these systems are overwhelmed by a flood of HTTP requests, they can begin to degrade in performance or fail altogether. Faced with the prospect of their servers and websites becoming entirely unavailable, operations staff may make the difficult decision to turn off certain protections to preserve overall availability. However, this comes at a high cost: with application-layer defenses disabled, attackers gain a clear path to launch secondary attacks, such as exploiting web application vulnerabilities to carry out data breaches, deface websites, or engage in other malicious activity that would otherwise be blocked.
Amplifying Phishing and Campaigns
The turmoil caused by DDoS attacks can heighten the sense of urgency within an organization, leaving both employees and customers feeling overwhelmed and under pressure. In this state of confusion, individuals are far more susceptible to phishing emails, fraudulent communications, or other social engineering tactics designed to exploit the disruption. Attackers may take advantage of the chaos by impersonating IT staff, executives, or trusted vendors, using the ongoing incident as a pretext to manipulate targets into divulging sensitive information or taking actions they would otherwise scrutinize more carefully.
Disrupting Access to Primary Communication Channels
DDoS attacks can be strategically utilized in conjunction with misinformation campaigns to prevent users from accessing an organization's primary communication channels, such as its official website. This tactic is particularly consequential when targeting government websites, which often serve as a critical source of accurate and timely information for the public. By causing an outage, threat actors can amplify the spread of misinformation, create confusion, and erode trust in the affected institution.
By leveraging these strategies, adversaries can significantly enhance the overall impact and success of their broader attack campaigns, necessitating a holistic approach to defense strategies.
Reframing the DDoS Narrative
Throughout this post, we have examined why the common descriptions of DDoS attacks as a "distraction" or "smokescreen" fail to provide meaningful guidance to SOC and NOC operators.
Frameworks like MITRE ATT&CK exist to give incident responders a clear map of attacker TTPs, enabling them to identify and respond to threats based on observed behaviors. By relying on vague, inaccurate classifications and incomplete associations with other threat behaviors, we undermine the effectiveness of these frameworks and the operators who depend on them.
