What attacks target BGP?

BGP is targeted by route hijacking, route leaks, prefix spoofing, and session disruption. Attackers can divert traffic, cause interception, or make networks unreachable by advertising incorrect routes or exploiting weak trust between peers. Defenders should validate announcements, monitor route changes, secure peer relationships, and use filtering and route origin controls where available.

What kinds of attacks target BGP?

BGP is attacked by manipulating route announcements and peer trust. The most common patterns are route hijacking, route leaks, prefix spoofing, and session disruption, all of which can redirect, intercept, or blackhole traffic. The practical issue is not just “bad routes”, but that BGP was designed to exchange reachability, not to prove that every announcement is legitimate.

At the protocol level, the attacker usually abuses one of two weaknesses: weak origin validation or weak session trust. A false announcement can make an attacker look like the best path for a prefix, while a disrupted peering session can force instability, fallback routing, or traffic loss. That is why filtering, announcement validation, and peer hardening matter as much as detection.

Different attacks have different effects. A hijack tends to divert traffic toward the attacker or an unintended network. A leak spreads routes beyond their intended scope and can create large-scale instability. Prefix spoofing is often used to impersonate ownership of address space, while session disruption aims at availability by breaking the control plane relationship between routers. The same event can also be used for interception, covert manipulation, or denial of service.

How BGP attacks affect routing, reachability, and trust

BGP attacks succeed because routing decisions are made from announcements that may be syntactically valid but operationally false. If a more specific or apparently better route is accepted, downstream networks may follow it even when the route should never have been advertised. That makes BGP abuse especially dangerous in multi-provider and transited environments where trust is distributed across many peers.

BGP and Routing Security Guide is the most direct place to understand how hijacks, route leaks, RPKI, route origin validation, filtering, and response fit together. For operators, the important lesson is that announcement validation reduces abuse at scale, but it does not eliminate the need to watch for path changes, abnormal origins, and unexpected more-specifics.

Session disruption is a separate failure mode from route falsification. If the peering relationship is unstable or weakly protected, traffic may oscillate, routes may be withdrawn, and services can become intermittently unreachable. In practice, control-plane instability can be as damaging as overt hijacking because users see loss of connectivity even when no single prefix has been “stolen”.

Network Ports and Protocols Security Guide helps place BGP beside the broader protocol-hardening problem, especially where insecure management exposure, weak peer segmentation, or poorly controlled routing adjacencies create avoidable attack paths. The key security point is that routing trust is only as strong as the surrounding network hygiene.

What defenders should verify when BGP abuse is suspected

When BGP abuse is possible, the first question is whether the network is actually advertising what it should. That means checking announced prefixes, origin AS changes, sudden appearance of more-specific routes, and path shifts that do not match your normal topology. If the route change is unexpected, treat it as a routing integrity event, not just a performance issue.

CISA cyber threat advisories are useful when a BGP event is part of a broader incident pattern or coordinated disruption campaign. For defenders, advisories matter because routing abuse often shows up alongside service degradation, exposure of internal paths, or downstream incident response activity that needs to be correlated quickly.

Validation controls also need operational testing. If you rely on prefix filtering or route origin controls, confirm they are actually enforced at the edges where announcements enter your environment. If you rely on monitoring, make sure route-change alerts are actionable and tied to a clear ownership path, otherwise the first sign of compromise may be user complaints, not telemetry.

Risk and Threat Considerations

BGP attacks are dangerous because they target the trust fabric of the internet itself. A successful hijack or leak can cause interception, outage, or large-scale misdelivery of traffic, and the impact often spreads beyond the directly affected AS because routing decisions propagate quickly.

Failure mechanism: An attacker exploits weak origin validation, permissive filtering, or peer trust to introduce false reachability information, or disrupts a session so that legitimate routes are withdrawn or replaced.

Impact: Traffic can be diverted, observed, blackholed, or destabilised across multiple networks, creating confidentiality, availability, and operational risk at internet scale.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SC-7 — Boundary Protection	BGP attacks abuse trust at network boundaries and peering edges.
	AC-4 — Information Flow Enforcement	Route hijacking and leaks alter permitted network flow paths.
	SI-4 — System Monitoring	BGP abuse is often detected through abnormal route changes and path shifts.
Recommendation — Enforce boundary filtering and control external routing adjacencies at network edges. Restrict route propagation to approved peers and prefixes. Monitor routing events for unexpected origins, more-specifics, and session instability.
CIS Controls v8	CIS-12 — Network Infrastructure Management	BGP security depends on hardened routing infrastructure and controlled changes.
Recommendation — Harden routers and manage routing policy changes through controlled processes.
NIST CSF 2.0	DE.CM-01 — Networks and systems are monitored to detect anomalies	BGP attacks are surfaced through anomalous routing and path behaviour.
Recommendation — Monitor routing telemetry for unexpected prefix, origin, and path changes.

Practitioner Guidance

What to prioritise: Validate announcements first, then harden peer relationships. If a route is accepted from an unexpected origin or path, treat the event as a routing incident before you spend time proving attacker intent.

What to verify: Check that prefix filters, max-prefix limits, origin validation, and route monitoring are active on the actual peering edges. A control that exists on paper but is not enforced at the boundary will not stop a hijack or leak.

Practitioner takeaway: The most effective BGP defence is to combine route validation with continuous change detection, because BGP failures usually become visible only after traffic has already been misdirected or dropped.