The Campaign
Beginning March 16, 2026, a major enterprise customer came under a sustained and coordinated DDoS campaign. Over the course of seven days, attackers launched 27 separate attacks against 320 protected IP addresses, generating a total of 3 Tbit of malicious traffic across 487.6 million packets. The primary target throughout the campaign was a /28 subnet that received the overwhelming majority of attack volume. Secondary targets included numerous individual IP addresses across a second IP range, each subjected to repeated attack waves lasting 10 to 32 minutes.
The Peak Attack — March 21, 2026
The most significant single event in the campaign occurred on March 21, 2026, beginning at approximately 10:30 am (Asia/Jerusalem). FlowSec’s system immediately began receiving alerts regarding a high-volume attack on the customer’s primary subnet.
The attack unfolded in two vectors:
Vector 1 — GRE flood: A GRE protocol flood peaked at 4.04 Gb/s and 647.68 Kp/s, with an average throughput of 1.07 Gb/s over 19 minutes. This vector alone was more than eight times the customer’s line capacity.
Vector 2 — Residual traffic monitoring: Following the initial burst, FlowSec’s system continued monitoring and suppressing low-level residual attack traffic for an additional 51 minutes, ensuring no secondary escalation went undetected.
Total attack time for this event: 1 hour and 10 minutes. FlowSec’s system detected the attack, generated mitigation signatures, and pushed them to the relevant routers. Email alerts were dispatched in real time throughout the detection and mitigation process.
At the conclusion of the attack, once traffic returned to normal levels, all signatures were automatically removed in accordance with system settings.
FlowSec Global Shield
FlowSec’s Global Shield solution provided continuous, autonomous protection throughout the seven-day campaign. The system identified each of the 27 attack waves, generated targeted mitigation signatures, and propagated them instantly to the customer’s routers. No manual intervention was required at any stage. The customer’s services remained fully operational throughout the campaign, with no disruption to end users.
