Zhadnost DDoS attacks show how misconfigured routers scale disruption

At a glance

What this is: This is SecurityScorecard's analysis of the Zhadnost DDoS campaign, which used misconfigured routers and amplification traffic to target Ukrainian government and financial sites.

Why it matters: It matters because misconfigured internet-facing infrastructure can become shared attack capacity, so resilience, exposure management, and traffic controls need to assume globally distributed abuse.

Context

DDoS resilience is not only a problem of bandwidth or scrubbing capacity. When routers and other edge devices expose insecure DNS recursion or related misconfigurations, they can be turned into amplification nodes that flood a target without the target needing to be directly compromised.

This article is also relevant to identity and access governance because the attack surface includes unmanaged devices, externally reachable services, and operational settings that persist outside central control. For security teams, that is a governance problem as much as a network availability problem.

The Zhadnost case is typical of modern amplification campaigns: the attacker did not need novel malware on the target side, only a large, dispersed set of weakly governed devices that could be recruited at scale.

Key questions

Q: What breaks when DNS recursion is left enabled on internet-facing routers?

A: When DNS recursion is left enabled on internet-facing routers, those devices can be used as reflection and amplification nodes in DDoS attacks. Attackers can spoof requests so that the router sends large responses toward the victim, multiplying traffic without needing full compromise of every device. The result is distributed abuse capacity created from ordinary misconfiguration.

Q: Why do misconfigured edge devices create DDoS risk even without malware?

A: They create risk because the attacker does not need to install payloads on the target side. If enough devices will answer spoofed requests, the attacker can generate large floods from distributed infrastructure that already exists, which lowers cost, raises scale, and complicates attribution.

Q: How can security and fraud teams tell whether their controls are failing?

A: Look for two signals at once: rising false positives that push real customers away and rising fraud leakage that appears only after chargeback analysis. If both are increasing, the decision layer is probably too slow, too binary, or too detached from session context.

Q: Should organisations prioritise resolver hardening or DDoS scrubbing first?

A: Resolver hardening should come first because it reduces the amount of attack traffic that can be generated in the first place. DDoS scrubbing is still valuable, but it is a compensating control. The strongest posture combines both, with source filtering and response limits preventing abuse upstream of mitigation.

Technical breakdown

How DNS amplification turns small requests into large traffic bursts

DNS amplification abuses a resolver or router that will answer recursive queries from anywhere on the internet. The attacker sends spoofed requests that make the device send larger replies to a victim, multiplying traffic without needing direct control of the victim network. In this case, SecurityScorecard says the Zhadnost bots were mostly MikroTik routers with recursion enabled, which made them suitable reflectors. The important architectural point is that the bottleneck is not the attacker's sending capacity but the number of misconfigured responders that will willingly amplify traffic. That is why even modest attacker infrastructure can generate outsized disruption.

Practical implication: disable open recursion on edge devices unless there is a narrowly governed operational need.

Why misconfigured routers behave like distributed attack infrastructure

A router with recursion enabled and exposed management or service settings is not just a device, it is a reusable network asset from an attacker's perspective. If thousands of routers share the same unsafe default or weak configuration, they can be enumerated, tested, and weaponised in parallel. SecurityScorecard describes a botnet of more than 3,000 unique IP addresses spread across countries and continents, which shows how routing infrastructure can be transformed into a global resource pool for abuse. The relevant control gap is governance of configuration state across unmanaged or semi-managed edge devices, not just malware detection on endpoints.

Practical implication: treat edge-device configuration drift as an availability risk and continuously inventory externally reachable routers.

Why DDoS campaigns succeed even when direct compromise is limited

DDoS does not require deep footholds in the target environment. Once traffic generation is distributed, the attacker can rely on overload, reflection, and amplification to create service degradation. SecurityScorecard reports that the Ukrainian targets were restored quickly and customer balances were not affected, which suggests strong response capacity, but the campaign still demonstrates how a public-facing service can be disrupted without persistent intrusion. For defenders, the technical lesson is that availability controls must address upstream traffic sourcing, not only downstream service hardening. The abuse pattern is outside the target perimeter until it is already in effect.

Practical implication: combine upstream filtering, scrubbing, and exposure reduction rather than relying on perimeter firewalls alone.

Threat narrative

Attacker objective: The objective was to deny access to Ukrainian government information and financial services by overwhelming public-facing websites with distributed traffic.

1. Entry began with globally distributed routers and other devices that had DNS recursion enabled or similar exploitable settings, allowing them to answer spoofed traffic.
2. The attacker used those devices as reflectors and amplifiers, generating HTTP floods in one campaign and DNS amplification in the others.
3. The resulting traffic saturated Ukrainian government and financial websites, temporarily degrading service and user access while leaving core balances and systems intact.

Breaches seen in the wild

• Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Misconfigured edge infrastructure is now a resilience liability, not just a hygiene issue. This campaign shows that weak router configuration can be converted into distributed attack capacity with almost no need for bespoke tooling. The governance lesson is that availability risk now starts at the configuration boundary of internet-facing devices, not inside the protected network.

Amplification campaigns expose a control gap that traditional endpoint-centric security cannot close. The source devices in Zhadnost were routers and other edge systems, not endpoints under typical EDR coverage. That means network security teams need ownership of externally reachable infrastructure state, especially DNS recursion, exposed services, and service defaults. Practitioners should treat unmanaged edge exposure as a standing operational risk.

Attack surface inventory must include devices that can be abused as sources, not only assets that hold sensitive data. The article's reference to thousands of IPs across many countries shows that attackers need breadth more than depth when reflection is available. For defenders, the named concept here is reflection-ready infrastructure: public devices that can be turned into attack accelerants because their configuration is permissive. Practitioners should prioritise exposure reduction on systems that can source traffic at scale.

Availability governance and identity governance intersect where control ownership is fragmented. When a device is outside normal lifecycle and privilege management, the organisation loses visibility into who can change its recursion state, service settings, or remote access posture. That gap is not an identity failure in the narrow sense, but it is the same governance pattern: an asset with operational power that is not tightly controlled throughout its lifecycle.

Resilience planning should assume adversaries will use neutral infrastructure at global scale. SecurityScorecard's analysis makes clear that blocking a single region or a small set of known hosts is insufficient when the attack source is a dispersed botnet of routers. The practitioner implication is to design for broad source diversity, rapid traffic mitigation, and configuration hardening at the edge.

What this signals

Reflection-ready infrastructure is the right way to think about this campaign: any public device that can answer spoofed queries becomes part of an adversary's supply of traffic. For practitioners, the governance question is whether configuration ownership is strong enough to prevent edge devices from becoming reusable attack assets.

The Zhadnost case shows that resilience programmes need visibility into configuration state across routers, not just endpoint telemetry or application-layer protection. If recursion, test services, or remote access features are left in unsafe states, the organisation has already ceded a portion of its availability control to the public internet.

For practitioners

• Disable open DNS recursion on internet-facing routers Review all externally reachable routers and edge appliances for recursion settings, and turn recursion off unless a documented service requirement exists.
• Inventory and classify edge devices by exposure Build and maintain an inventory of routers and other devices that can generate or reflect traffic, then flag models and services that create amplification risk.
• Harden service defaults on MikroTik and similar devices Audit exposed ports, bandwidth-test services, and management interfaces on routers so default services do not become reflection paths.
• Use upstream DDoS mitigation for public services Route internet-facing services through scrubbing or mitigation providers that can absorb or filter flood traffic before it reaches critical web and banking systems.
• Separate resilience planning from firewall assumptions Assume that a firewall alone will not stop high-volume floods and align traffic engineering, provider controls, and incident response playbooks accordingly.

Key takeaways

• Misconfigured routers and other edge devices can be weaponised into distributed DDoS infrastructure without a direct breach of the target.
• SecurityScorecard's analysis found more than 3,000 unique IP addresses involved in the later Zhadnost attacks, showing how quickly reflection abuse can scale.
• The most effective defence is to reduce the number of devices that can be abused as sources while pairing that work with upstream traffic mitigation.

Key terms

• DNS Amplification Attack: A DNS amplification attack is a reflection-based denial of service technique that uses small spoofed queries to trigger much larger DNS responses toward a victim. The attacker spends little bandwidth while the target absorbs the resulting traffic flood, often through open resolvers or misconfigured DNS infrastructure.
• Reflection Attack: An attack pattern that spoofs the victim's address so third-party systems send traffic to the target instead of the attacker. It is common in DDoS operations because it hides the attacker source and lets ordinary exposed services become force multipliers.
• Recursive DNS: Recursive DNS is the lookup layer that takes a user or service query and walks the DNS hierarchy until it finds an answer. It is critical to access delivery because a failure or slowdown here affects how quickly clients can reach applications, identity endpoints, and other trust services.
• Volumetric DDoS Attack: A volumetric DDoS attack seeks to exhaust network capacity by flooding a target with massive amounts of traffic. The pressure is on bandwidth and infrastructure throughput rather than on a specific application weakness. Defenses usually focus on filtering, absorbing, or rate-limiting traffic before it overwhelms the service.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and workload identity. It helps practitioners connect identity controls to the wider security programmes they run across cloud and enterprise environments.