Fortify Your Network Security from Emerging Geopolitical Cyberthreats

Key Takeaways

• Akamai observed a 245% increase in cybercrime targeting North America, Europe, and APAC following the start of a Middle East conflict in early 2026.
• The Iran-linked hacktivist group Handala claimed responsibility for a massive data-wiping attack against medical technology company Stryker.
• Banking, financial services, ecommerce, and video games account for 80% of the targeted destinations for malicious traffic.
• Threat actors are heavily utilizing proxy services in countries like Russia and China to launch billions of designed-for-abuse connection attempts.
• Significant increases were observed in automated reconnaissance (+65%), botnet-driven discovery (+70%), and infrastructure scanning (+52%).

Affected Systems

• Banking and financial services infrastructure
• Ecommerce platforms
• Video game networks
• Critical public infrastructure
• Medical technology systems

Attack Chain

Threat actors leverage proxy services in regions like Russia and China to mask their origins. They conduct large-scale automated reconnaissance, infrastructure scanning, and botnet-driven discovery to identify exposed services and vulnerabilities. Following reconnaissance, actors execute credential harvesting and pre-DDoS probing, culminating in disruptive actions such as volumetric DDoS attacks or targeted data-wiping operations against critical infrastructure.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: Yes
• Platforms: Akamai Prolexic

The article provides specific Akamai Prolexic Network Cloud Firewall geo-blocking rules (e.g., deny ip GEO:: RU any, deny ip GEO:: IR any) to mitigate the observed malicious traffic.

Detection Engineering Assessment

EDR Visibility: Low — The threats discussed are primarily volumetric network attacks, reconnaissance, and scanning, which are detected at the network edge rather than the endpoint. Network Visibility: High — The activity consists of massive spikes in connection attempts, automated scanning, and pre-DDoS probing, which are highly visible in network traffic logs and edge firewall telemetry. Detection Difficulty: Easy — Volumetric scanning and massive traffic spikes from unexpected geolocations are relatively easy to detect using standard network monitoring and geo-IP filtering.

Required Log Sources

• Edge Firewall Logs
• WAF Logs
• NetFlow/IPFIX
• Web Server Access Logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Threat actors are conducting large-scale infrastructure scanning from unexpected geolocations (e.g., Russia, Iran) targeting edge services.	Edge Firewall Logs, WAF Logs	Reconnaissance	Low (if the organization has no legitimate business in those regions)
Adversaries are performing pre-DDoS reconnaissance by sending bursts of traffic to critical APIs and web applications.	WAF Logs, Load Balancer Logs	Reconnaissance	Medium (could be confused with legitimate traffic spikes or benign web crawlers)

Control Gaps

• Lack of edge-level geo-blocking
• Insufficient rate limiting on critical APIs

Key Behavioral Indicators

• Sudden spikes in connection attempts from specific ASNs or countries
• High volume of 403/404 errors indicating infrastructure scanning
• Repeated failed login attempts indicating credential harvesting

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Implement geo-blocking rules at the network edge to deny traffic from regions where the organization does not conduct business (e.g., Russia, Iran).
• Review and enforce rate limiting and IP reputation controls for websites and critical applications.

Infrastructure Hardening

• Deploy always-on DDoS security controls to mitigate volumetric attacks.
• Implement microsegmentation to prevent lateral movement if the perimeter is breached.
• Review critical subnets and ensure mitigation controls are active.

User Protection

• Monitor for credential harvesting attempts and enforce multi-factor authentication (MFA) across all external-facing services.

Security Awareness

• Exercise incident response runbooks, validating emergency plans, contacts, and lockdown policies for critical assets.

MITRE ATT&CK Mapping

• T1595 - Active Scanning
• T1595.002 - Vulnerability Scanning
• T1589 - Gather Victim Identity Information
• T1485 - Data Destruction
• T1498 - Network Denial of Service
• T1090 - Proxy