Friday, May 23, 2025
HomeSecurity NewsHackers Abused Memcached Servers for high-bandwidth Amplification DDoS Attacks

Hackers Abused Memcached Servers for high-bandwidth Amplification DDoS Attacks

Published on

SIEM as a Service

Follow Us on Google News

Attackers abused vulnerable Memcached Servers to launch high-bandwidth DDoS attacks and there is a huge increase observed in this attack vector.

Memcached is a memory caching system used to speed up a dynamic database of the websites by caching the data in RAM which can increase the loading time by reducing the number of times an external data source must be read.

It is a middleware so it lacks access controls and it should not be exposed to the public Internet, according to Shodan reports there are around 88,000 open Memcached servers found.

If the UDP port(11211) is opened then attackers can exploit by sending thousands of forged requests to a vulnerable UDP server and servers process the request without knowing it is forged one, which results in overwhelming of its resources.
- Advertisement - Google News

Cloudflare says a carefully carfted technique allows an attacker with limited IP spoofing capacity (such as 1Gbps) to launch very large attacks (reaching 100s Gbps) “amplifying” the attacker’s bandwidth.

Also Read DDoS attack prevention method on your enterprise’s systems – A Detailed Report

According to DDoS Threat Landscape, the Memcached graph is almost flat and the spike is only just for a couple of the days.

Memcached Servers

Cloudflare says at peak it generated 260Gbps of inbound UDP traffic and the majority of the packets size is 1400 bytes. Doing the math 23Mpps x 1400 bytes gives 257Gbps of bandwidth.

Launching the attack is quite simple, all attacker need is to embed a large payload on an exposed Memcached server and then the attacker spoofs the “get” request message with target Source IP.

The Vulnerable Memcached servers present all over the globe and according to Shodan search reports, there are 88,000 open Memcached servers.

Memcached Servers

Security researchers recommended disabling the UDP support if it is not in use and to place the Memcached servers behind the Firewall. Also, it is recommended to specify Memcached servers to listen only on localhost.

Reports on Memcache DDoS Attacks published by Cloudflare and arbornetworks.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Global Crackdown Nets 270 Dark Web Vendors in Major Arrests

A sweeping international crackdown, codenamed Operation RapTor, has dealt a significant blow to the...

CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets

On May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent...

CefSharp Enumeration Tool Identifies Critical Security Issues in .NET Desktop Applications

Cybersecurity researchers and red teamers, a newly released tool named CefEnum is shedding light...

Russian Hackers Exploit Oracle Cloud Infrastructure to Target Scaleway Object Storage

Russian threat actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Phishing Campaign Uses Blob URLs to Bypass Email Security and Avoid Detection

Cybersecurity researchers at Cofense Intelligence have identified a sophisticated phishing tactic leveraging Blob URIs...

UK Government to Shift Away from Passwords in New Security Move

UK government has unveiled plans to implement passkey technology across its digital services later...

New Spam Campaign Leverages Remote Monitoring Tools to Exploit Organizations

A sophisticated spam campaign targeting Portuguese-speaking users in Brazil has been uncovered by Cisco...