ATO Attack Mitigation: How Radware Bot Manager Blocked a Massive Attack Campaign

The combination of seamless user experiences and increasing consumer confidence in online transactions has enabled the digital economy to reach unprecedented heights, with millions of consumers adopting online platforms for their shopping or financial needs. Major shopping events like Black Friday and Cyber Monday alone generate billions in online transactions, making it the ultimate proving ground for online retailers, and coincidentally, also for cybercriminals. While genuine customers hunt for the best deals during these sales events, malicious actors hunt for access to user accounts loaded with cash, payment information, and sensitive personal data.

This past year, one of our major retail clients faced exactly this scenario- a sophisticated, large-scale Account Takeover (ATO) attack targeting their login workflows during the biggest shopping event of the year. Thanks to robust protection provided by the Radware Bot Manager, a major security breach was successfully averted while customers felt no impact on their shopping experience.

ATO Attacks 101

Account Takeover (ATO) attacks are one of the most damaging forms of cyberattacks targeting online businesses today. These attacks involve cybercriminals gaining unauthorized access to user accounts through various methods, including bot-driven credential stuffing/cracking, API business logic attacks, and social engineering techniques. Once successful, attackers exploit compromised accounts for fraudulent purchases, sensitive data theft, or serve as the foundation for larger attacks.

While ATO attacks are one of the biggest cyber threats faced year-round by organizations across sectors, highly anticipated events such as Black Friday, Cyber Monday, etc. represent the perfect mix of opportunity and vulnerability for attackers. The massive surge in legitimate traffic during these events, with customers actively using stored payment methods or updating sensitive information, makes successful account compromises immediately valuable and monetizable through account fraud.

Anatomy of an ATO Attack

Over the course of this past holiday shopping season, one of our client’s e-retail platforms was targeted with a sustained ATO attack campaign, with over 500,000 account takeover attempts recorded in a period of 30 days.