Topic starter
12/07/2026 12:27 pm
TL;DR: Three DDoS campaigns against Ukrainian government and financial sites used more than 3,000 unique IP addresses, with HTTP floods in one case and DNS amplification in the others, and most nodes were MikroTik routers with recursion enabled, according to SecurityScorecard. The lesson is that exposed, misconfigured infrastructure can be turned into globally distributed attack capacity far faster than many defenders expect.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “SecurityScorecard Discovers new botnet, ‘Zhadnost,’ responsible for Ukraine DDoS attacks”.
Key questions
Q: What breaks when DNS recursion is left enabled on internet-facing routers?
A: When DNS recursion is left enabled on internet-facing routers, those devices can be used as reflection and amplification nodes in DDoS attacks.
Q: Why do misconfigured edge devices create DDoS risk even without malware?
A: They create risk because the attacker does not need to install payloads on the target side.
Q: How can security and fraud teams tell whether their controls are failing?
A: Look for two signals at once: rising false positives that push real customers away and rising fraud leakage that appears only after chargeback analysis.
Practitioner guidance
- Disable open DNS recursion on internet-facing routers Review all externally reachable routers and edge appliances for recursion settings, and turn recursion off unless a documented service requirement exists.
- Inventory and classify edge devices by exposure Build and maintain an inventory of routers and other devices that can generate or reflect traffic, then flag models and services that create amplification risk.
- Harden service defaults on MikroTik and similar devices Audit exposed ports, bandwidth-test services, and management interfaces on routers so default services do not become reflection paths.
Bottom line: Misconfigured routers and other edge devices can be weaponised into distributed DDoS infrastructure without a direct breach of the target.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:39 pm
Misconfigured edge infrastructure is now a resilience liability, not just a hygiene issue. This campaign shows that weak router configuration can be converted into distributed attack capacity with almost no need for bespoke tooling. The governance lesson is that availability risk now starts at the configuration boundary of internet-facing devices, not inside the protected network.
A question worth separating out:
Q: Should organisations prioritise resolver hardening or DDoS scrubbing first?
A: Resolver hardening should come first because it reduces the amount of attack traffic that can be generated in the first place. DDoS scrubbing is still valuable, but it is a compensating control. The strongest posture combines both, with source filtering and response limits preventing abuse upstream of mitigation.
👉 Read our full editorial: Zhadnost DDoS attacks show how misconfigured routers scale disruption