Japanese Businesses Hit By a Surge In DDoS Attacks

HED (50): Japanese Businesses Hit By a Surge In DDoS Attacks

DEK (81): DDoS Attacks Are Primarily Targeting Logistics, Government and Financial Entities

KEYWORDS: Fraud Management & Cybercrime

SUMMARY (281): Leading Japanese organizations, including the national airline, the largest wireless carrier, and two of the country’s largest banks, suffered targeted distributed denial-of-service attacks during the holiday season that disrupted public-facing online services for varying periods.

– – -

A spate of distributed denial-of-service attacks during the end-of-year holiday season disrupted operations at multiple Japanese organizations, including the country’s largest airline, wireless carrier and prominent banks.

See Also: 2024 CISO Insights: Navigating the Cybersecurity Maelstrom

Japan’s largest wireless carrier NTT Docomo said Thursday that a series of distributed denial-of-service attacks disrupted its “goo” portal site, internet service, on-demand video streaming service, e-commerce site Dpay and its golf subscription service.

The wireless carrier, which offers cellular and mobile Internet to approximately 90 million users in Japan, said the disruptions began early Thursday morning and lasted another 11 hours.

Osaka-based Resona Bank this week said a DDoS attack resulted in a network malfunction and impacted the functioning of its customer-facing My Gate application. The outage caused hiccups for a brief period, but did not cause any customer data leak or virus infection.

The parent company Resona Holdings said the incident temporarily disrupted services at other company-owned banks, including Minato Bank, Kansai Mirai Bank and Saitama Resona Bank.

Japan Times reported that Mizuho Bank, Japan’s third largest financial company, suffered a similar denial-of-service attack that disrupted online banking services for three hours on Tuesday morning.

The attacks took place not long after Mitsubishi-owned MUFG Bank, the country’s largest bank with over $235 billion of assets under management, said it suffered network issues during the afternoon of Dec. 26 that impacted the functioning of customer-facing Mitsubishi UFJ Direct, BizSTATION, and COMSUITE portals.

Japan Airlines also experienced a possible denial-of-service attack during the Christmas holiday break that delayed 24 domestic flights by over 30 minutes and disrupted online ticket sales and internal systems. The airline said the incident was contained within hours and did not result in a customer data leak (see: Breach Roundup: Cyberattack Disrupts Japan Airlines).

The surge in denial-of-service attacks targeting prominent Japanese companies followed a similar spurt in such attacks by Kremlin-linked hackers in October after Japan and the United States announced plans to conduct military exercises near the coast of eastern Russia. The DDoS attacks targeted the majority political party, major manufacturers, business groups and local governments (see: Military Exercises Trigger Russian DDoS Attacks on Japan).

Russian self-proclaimed hacktivists also executed a series of DDoS attacks in June after Japan supported a G7 proposal to use earnings from frozen Russian assets to secure a $50 billion loan in favor of Ukraine.

Cybersecurity company Netscout in October found a majority of DDoS attacks launched by Russian groups in 2024 against Japanese networks targeted logistics and manufacturing facilities, particularly harbors and shipbuilding facilities, followed by government and political agencies and financial organizations.

The NoName057(16) group, which claimed a series of DDoS attacks in October, used four distinct DDoS attack vectors and approximately 30 different attack configurations to maximize the impact of each attack. The group flooded each targeted website with three waves of attacks.

“Netscout observes approximately 2,000 DDoS attacks targeting Japanese networks daily,” the company said. “These attacks display patterns like those observed in other regions, including the use of direct-path attack vectors and common sources, often involving nuisance networks, as well as legitimate cloud providers and VPNs.”

The National Police Agency of Japan said in December that cybercriminals prefer to mount denial-of-service attacks because DDoS attack services are inexpensive to use and require no technical knowledge on part of the user,.

NPA participated in a joint investigation led by Europol in December which resulted in the takedown of 27 DDoS booter web services in multiple countries. The agency said it arrested three individuals who used DDoS attack web services and has warned businesses about further DDoS attacks targeting their networks in the near future.