Why do exposed routers and proxies make DDoS campaigns harder to stop?

Why This Matters for Security Teams

Exposed routers and proxies turn a straightforward volumetric attack into a distributed problem. Instead of one or a few malicious hosts, defenders may see flood traffic coming from consumer devices, remote offices, cloud edges, and open proxies that were never meant to be trust anchors. That makes reputation-based blocking, simple geofencing, and single-source rate limiting far less effective. Guidance from the ENISA Threat Landscape consistently highlights distributed abuse as a complicating factor in modern disruption campaigns.

The operational issue is not just scale. Exposed intermediaries also distort visibility. Logs may reflect the proxy address, the upstream router, or a chain of relays, which slows triage and weakens confidence in attribution. That matters because mitigation decisions often depend on whether the attack is a botnet burst, an application-layer flood, or a reflected campaign using third-party infrastructure. In practice, many security teams encounter the true blast radius only after the service is already degraded, rather than through intentional exposure management.

How It Works in Practice

Attackers use exposed routers and proxies because they provide reach, obscurity, and distribution. A router with permissive forwarding, weak management exposure, or abused NAT behaviour can amplify traffic patterns or make source tracing noisy. A proxy can serve as an exit point that separates the attacker from the victim, while also adding legitimate-looking network paths that complicate filtering. The result is not always raw amplification in the classic sense; often the value is operational camouflage and source dispersion.

Security teams usually have to combine several controls rather than depend on one blocking rule. Common steps include:

• Hardening internet-facing routers and proxies, including removing unnecessary services and restricting management access.
• Applying upstream rate limiting and scrubbing with the internet service provider or DDoS mitigation provider.
• Using flow telemetry and packet inspection to distinguish proxy-borne traffic from normal bursty use.
• Correlating logs across the perimeter, load balancers, and application tiers to identify which layer is being stressed.
• Tracking known abuse infrastructure and emerging botnet patterns with intelligence sources such as Anthropic — first AI-orchestrated cyber espionage campaign report where automation and adaptive targeting are part of the campaign playbook.

There is also an identity and access angle when proxies are abused to conceal the origin of privileged sessions, admin interfaces, or API calls. That is where PAM, strong device authentication, and ZTA principles matter, because the network address alone is not a reliable trust signal. Current guidance suggests treating exposed infrastructure as hostile until proven otherwise, especially when it can relay traffic on behalf of unauthenticated users. These controls tend to break down in highly dynamic cloud and ISP environments because IP reputation changes too fast for static blocklists to remain effective.

Common Variations and Edge Cases

Tighter upstream filtering often reduces attack volume, but it also increases coordination overhead, requiring organisations to balance rapid suppression against the risk of collateral blocking. That tradeoff becomes more pronounced when the campaign uses residential proxies, compromised SOHO gear, or legitimate content delivery paths that resemble hostile traffic.

Best practice is evolving for environments where proxies are part of normal architecture. For example, a business that intentionally uses forward proxies, VPN concentrators, or regional edge routers cannot simply deny all proxy-originating traffic without harming legitimate users. In those cases, defenders need layered trust signals, behaviour-based detection, and service-specific rate controls rather than broad source denial. The same issue appears in multi-tenant hosting, where one noisy tenant can resemble a distributed attack unless telemetry is properly segmented.

Another edge case is command-driven automation. When attackers use orchestration to rotate through exposed devices quickly, defenders may not see a stable pattern long enough for manual blocking. That is why many teams combine network protections with incident response playbooks and continuous exposure review. Where proxies are required for business function, the practical goal is not elimination but containment, stronger authentication, and faster isolation of abused nodes.

Related resources from NHI Mgmt Group

• Why do exposed credentials and service accounts make lateral movement harder to stop?
• Why do trusted platforms make attacker campaigns harder to stop?
• Why do agentic AI systems make fraud harder to stop with static rules?
• Why do fragmented betting markets make fraud harder to stop?