Distributed denial-of-service (DDoS) attacks are nothing new. Cybercriminals have been recruiting bots to do their dirty work for years, manipulating them into spamming company websites and causing collateral damage. What’s more, many companies feel the frequency of DDoS attacks isn’t decreasing.

DDoS attacks remain safe bets for cybercriminals looking to sow chaos or throw up smoke screens for more nefarious acts. According to Infosecurity Magazine, findings from a recent Neustar study backed up the feeling: In the last 12 months, almost 75 percent of all global firms suffered a DDoS attack, with half losing $100,000 per hour during peak periods.

Neustar Study Showed Startling Numbers

The numbers from Neustar don’t look promising: Of the nearly 750 C-suite executives who said they were victims of attack, 85 percent noted their company was hit by multiple DDoS attacks over the last year, while 29 percent came under attack between two and five times.

Just under half of respondents lost $100,000 during peak hours of bot takedown traffic, and one-third suffered losses of $250,000 or more. It gets worse — more than 70 percent of those asked said it took at least an hour to detect the DDoS attacks and another full hour to respond, meaning a minimum of $200,000 lost even if detection and defense came with relative ease.

Part of the problem is the increasing number of vulnerable IoT devices. Consider the recent Mirai attacks that leveraged IoT devices, such as remote cameras, to create a massive botnet army capable of attack volumes. While the underlying concept of DDoS hasn’t changed in years, it’s getting new lease on life thanks to the huge volume of unsecured, network-enabled devices now linked to the public internet.

Sophisticated and Relentless

DDoS attacks are occurring more frequently, and attackers are using them for more than just website takedowns. According to We Live Security, these denial-of-service efforts may be decoys meant to divert attention away from other, more worrisome attack routes. The Neustar study data bears this out, with more than half of respondents saying they’ve experienced additional compromises, such as virus, malware or ransomware infections, during a DDoS attack.

While IT professionals are focused on getting websites back online and stemming the tide of bot traffic, it’s often possible for attackers to slip small packages of code through strained security systems. If they’re smart, they dump Trojans onto the network and wait until the dust settles. When admins are back to business as usual, actors execute their package and start grabbing corporate data.

Regardless off their origin, motivation or speed, it’s clear that DDoS attacks remain a key antagonist in the IT security story. Now empowered by IoT devices and leveraged as expensive decoys, it’s no wonder so many firms have seen networks go down and IT outrage ramp up in the last 12 months.