Web protection firm Cloudflare warns that a small but powerful botnet has launched distributed denial-of-service (DDoS) attacks on roughly 1,000 organizations over the past month alone.
Dubbed Mantis, the botnet is responsible for a record-breaking 26 million requests per second (RPS) HTTPS DDoS attack observed in June, and it has since continued to display strength, with more than 3,000 attacks launched over the past several months.
Mantis is small, being powered by approximately 5,000 bots, but the fact that these are compromised virtual machines and powerful servers gives the botnet much more strength than its size would suggest.
“The Mantis botnet was able to generate the 26M HTTPS requests per second attack using only 5,000 bots. That’s an average of 5,200 HTTPS RPS per bot,” Cloudflare product manager Omer Yoachimik notes.
Yoachimik also points out that launching DDoS attacks over HTTPS is highly expensive in terms of computational resources, because they require establishing secure TLS encrypted connections.
“Mantis is the next evolution of the Meris botnet. The Meris botnet relied on MikroTik devices, but Mantis has branched out to include a variety of VM platforms and supports running various HTTP proxies to launch attacks,” Yoachimik explains.
Meris is believed to have launched record-breaking attacks last year, including a 22 million RPS DDoS assault at the beginning of September 2021, when it had roughly 200,000 bots, and a 17.2 million RPS attack two weeks before.
According to Cloudflare, the new Mantis botnet has also contributed to a spike in the number of HTTP DDoS attacks observed over the past month, being responsible for no less than 3,000 such assaults.
Most of these attacks (36%) targeted the internet and telecommunication sector, with the news, media, and publishing industry being the botnet’s second favorite target, followed by the gaming and finance sectors.
More than 20% of the targets were organizations in the United States and roughly 15% were Russian companies. Turkey, France, and Poland rounded up the top five list, with roughly 5% each.
Related: MikroTik Confirms Mēris Botnet Targets Routers Compromised Years Ago
Related: Small Botnet Launches Record-Breaking 26 Million RPS DDoS Attack
Related: Cloudflare Customer Targeted in Record HTTPS DDoS Attack

More from Ionut Arghire
- Votiro Raises $11.5 Million to Prevent File-Borne Threats
- Lumen Technologies Hit by Two Cyberattacks
- Leaked Documents Detail Russia’s Cyberwarfare Tools, Including for OT Attacks
- Severe Azure Vulnerability Led to Unauthenticated Remote Code Execution
- 500k Impacted by Data Breach at Debt Buyer NCB
- Chinese Cyberspies Use ‘Melofee’ Linux Malware for Stealthy Attacks
- Microsoft Cloud Vulnerability Led to Bing Search Hijacking, Exposure of Office 365 Data
- OpenAI Patches Account Takeover Vulnerabilities in ChatGPT
Latest News
- Italy Temporarily Blocks ChatGPT Over Privacy Concerns
- FDA Announces New Cybersecurity Requirements for Medical Devices
- Report: Chinese State-Sponsored Hacking Group Highly Active
- Votiro Raises $11.5 Million to Prevent File-Borne Threats
- Lumen Technologies Hit by Two Cyberattacks
- Leaked Documents Detail Russia’s Cyberwarfare Tools, Including for OT Attacks
- Mandiant Investigating 3CX Hack as Evidence Shows Attackers Had Access for Months
- Severe Azure Vulnerability Led to Unauthenticated Remote Code Execution
