Topic starter
12/07/2026 12:27 pm
TL;DR: More than 3,000 unique IP addresses figured in the later Zhadnost attacks, showing how quickly reflection abuse can scale, from SecurityScorecard's case work. Internet-facing routers with recursion enabled can be turned into source capacity unless operators reduce what can be abused upstream.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “SecurityScorecard Discovers new botnet, ‘Zhadnost,’ responsible for Ukraine DDoS attacks”.
Key questions
Q: Why do misconfigured edge devices create DDoS risk even without malware?
A: They create risk because the attacker does not need to install payloads on the target side.
Q: How can security and fraud teams tell whether their controls are failing?
A: Look for two signals at once: rising false positives that push real customers away and rising fraud leakage that appears only after chargeback analysis.
Q: What breaks when DNS recursion is left enabled on internet-facing routers?
A: When DNS recursion is left enabled on internet-facing routers, those devices can be used as reflection and amplification nodes in DDoS attacks.
Practitioner guidance
- Disable open DNS recursion on internet-facing routers Review all externally reachable routers and edge appliances for recursion settings, and turn recursion off unless a documented service requirement exists.
- Inventory and classify edge devices by exposure Build and maintain an inventory of routers and other devices that can generate or reflect traffic, then flag models and services that create amplification risk.
- Harden service defaults on MikroTik and similar devices Audit exposed ports, bandwidth-test services, and management interfaces on routers so default services do not become reflection paths.
Bottom line: Misconfigured routers and other edge devices can be weaponised into distributed DDoS infrastructure without a direct breach of the target.
Glossary terms: DNS Amplification Attack, Reflection Attack, Recursive DNS, Volumetric DDoS Attack
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
12/07/2026 12:39 pm
Misconfigured edge infrastructure is now a resilience liability, not just a hygiene issue. This campaign shows that weak router configuration can be converted into distributed attack capacity with almost no need for bespoke tooling. The governance lesson is that availability risk now starts at the configuration boundary of internet-facing devices, not inside the protected network.
A question worth separating out:
Q: Should organisations prioritise resolver hardening or DDoS scrubbing first?
A: Resolver hardening should come first because it reduces the amount of attack traffic that can be generated in the first place. DDoS scrubbing is still valuable, but it is a compensating control. The strongest posture combines both, with source filtering and response limits preventing abuse upstream of mitigation.
👉 Read our full editorial: Zhadnost DDoS attacks show how misconfigured routers scale disruption