• by Admin

The New Face of Multi-Vector Cyberattacks

There is one pattern that has started to emerge repeatedly in this year's cybersecurity reports: attackers are no longer content with using just one tactic. They are combining multiple techniques in a single campaign, and the result is an attack that is far harder to detect than the old model, which relied on just one vector.

Akamai, one of the world's largest providers of network infrastructure and security, highlights this trend in its latest report. According to the report, application layer (Layer 7) DDoS attacks, API abuse, and AI based attacks now overlap. They are no longer three separate threats, but rather a single multi vector attack package designed to cover each other's tracks.

Why Is This Different From Old School DDoS Attacks?

In the past, DDoS attacks were simple. Attackers would flood a server with traffic until it crashed, and the security team would simply block suspicious IP addresses or enable rate limiting. That was usually enough.

The problem is that Layer 7 attacks, which target the application layer rather than just network bandwidth, are far more sophisticated. Instead of sending millions of generic requests that are easily identified as bots, this type of attack mimics the behavior of real users. It opens pages, logs in, fills out forms, and calls APIs just as an ordinary human user would. Conventional traffic pattern based detection systems are left scrambling because, technically, those requests appear legitimate.

API: A Backdoor That Is Being Exploited More and More

What makes the situation even more complicated is the API. Almost all modern applications, from e commerce and fintech to streaming services, run on a stack of interconnected APIs. Each API endpoint is like a door, and the more doors there are, the more vulnerabilities there are to protect against.

Attackers no longer just try to flood APIs with traffic. They also exploit them in more subtle ways, such as credential stuffing through login endpoints, scraping data via public APIs that are supposed to serve specific features only, or exploiting the business logic behind the APIs themselves. This type of business logic abuse often slips under the radar of traditional web application firewalls.

AI Speeds Everything Up, On Both Sides

What makes this situation even more intense is the introduction of AI into attackers' arsenals. AI is now used to generate traffic that mimics human behavior far more convincingly than older generation bots. It is also used to automate the exploration of API vulnerabilities by testing thousands of parameter and endpoint combinations within a short amount of time, and to adjust attack strategies in real time as soon as defense systems detect and begin blocking them.

Ironically, security teams also use AI to defend themselves. AI helps detect behavioral anomalies, distinguish bot traffic from human traffic, and respond faster than humans can. This has effectively turned into an arms race, in which whoever adapts faster wins that round.

Why Is This Multi Vector Approach Dangerous?

The key point of the Akamai report is the issue of combination. Layer 7 DDoS attacks can be used as a smokescreen while security teams are busy putting out that fire. At the same time, API abuse attacks may be running quietly in the background to steal data or compromise accounts. Because the security team's attention and resources are divided, vulnerabilities that should be visible end up getting lost in the noise.

This is what makes the one tool for one threat security approach increasingly outdated. Companies need unified visibility, meaning the ability to view network traffic, API behavior, and AI driven anomaly patterns within a single view, rather than through disparate tools that do not communicate with one another.

What Can an Organization Do?

Here are some commonly recommended steps to address this trend.

1. First, conduct API audits and maintain an inventory. Many organizations do not even know exactly how many APIs they are running, a problem often referred to as shadow APIs, let alone monitor them properly.

2. Second, adopt behavior based detection rather than relying only on signature based detection, since attacks are getting smarter at mimicking legitimate traffic.

3. Third, use adaptive rate limiting instead of static rate limiting, so that defense patterns are not easily predictable.

4. Fourth, encourage cross team collaboration between network, application, and API security teams, because attacks now target all fronts simultaneously.

How Does Akamai Approach This Issue?

As one of the world's largest providers of edge infrastructure and security, Akamai has several product lines that are generally designed to address this kind of combined threat, although their functionality and integration may have changed since this information was compiled.

• Akamai App and API Protector is a solution that combines web application firewall protection and API security into a single platform, so security teams do not have to monitor application and API traffic separately.

• Akamai Bot Manager focuses on detecting and distinguishing bot traffic from genuine human traffic based on behavioral analysis rather than static signatures alone, which is especially relevant for combating AI powered bots that are becoming increasingly human like.

• Akamai Prolexic is a large scale DDoS mitigation service that typically serves as the first line of defense, absorbing both volumetric and Layer 7 attacks before they reach the core infrastructure.

• Kona Site Defender is an edge based web application firewall that operates at Akamai's distribution points, enabling attack filtering to occur as close as possible to the traffic source rather than waiting until it reaches the origin server.

The common thread in this approach is convergence. Since attacks are now combining DDoS, API abuse, and AI, Akamai promotes a converged defense model in which all signals, including network traffic, bot behavior, and API call patterns, are correlated on a single edge platform rather than scattered across separate tools that do not share information with one another.

In short

The line between network attacks, application attacks, and AI based attacks is becoming increasingly blurred. What were once considered three distinct issues have now become a single, coordinated front. For security teams, this means it is time to stop thinking in silos and start building defenses that can connect the dots just as quickly as attackers adapt.

Author: Ghea Devita

Marketing Communication PT Perkom Indah Murni