Bruno Simões · 16/09/2024
This is the account of how Kapta confronted a devastating cyberattack, acting quickly to save a client’s business. It is a reminder that, in the digital age, speed and expertise make all the difference.
Mondays are always the days when we arrive at work expecting emails or calls about questions, concerns or errors that occurred over the weekend. But we are never prepared for what happened last Monday: an urgent call from a client in complete despair. All their websites had been offline for more than two days. The financial impact? Around €20,000 per hour.
The situation was critical, and the stress visible on the client’s face was reflected in every word. They had placed their trust in us after being referred by another client, and we knew the responsibility was immense. Once we were granted server access, we quickly found the culprit: a DDoS (https://www.cloudflare.com/pt-br/learning/ddos/ddos-attack-tools/how-to-ddos/) attack (Distributed Denial of Service). A true digital nightmare.
Without wasting time, we moved all their websites behind Cloudflare, a powerful shield against attacks. However, the attackers were relentless. They already knew the server IP address, forcing us to consider moving to a new one.
Meanwhile, we analysed the logs and discovered that more than 18,000 IP addresses per minute were bombarding the server, while the client’s usual traffic was only 10,000 users per day. It was under siege.
We traced the source: the hacker was using Amazon servers from the United States, while 97% of the client’s business was European. After hours of analysis, we blocked the ASN (https://www.cloudflare.com/learning/network-layer/what-is-an-autonomous-system/) associated with those servers. Finally, the attack stopped.
This experience is a stark reminder that, in the digital world, security can never be taken for granted. Every second can make the difference between disaster and recovery.
