Silence is golden, especially in times of DDoS attacks

Should DDoS attacks on local operators be discussed? Of course. Should one tell in public who was attacked, how long he defended himself, how much the incident cost him and whether he ultimately paid the criminals? That's a completely different question. 

In a comment published on TELKO.in, titled "Pretending that no one pays ransom to Mr. Żabka won't help much," there is an accusation that organizations representing small and medium-sized operators are doing little to address the ongoing DDoS attacks and are even trying to limit public discussion about them.

No public communication does not mean no action. 

We don't bury our heads in the sand

MiŚOT Group dealt with the problem of operators' resilience to cyber attacks long before the current DDoS wave. She promoted scrubbing solutions, and through the MiŚOT Store she also offered specialized tools to protect the network and counteract DDoS attacks. Today, the topic is developed together with operators, technical experts and institutions responsible for the security of Polish cyberspace.

EPIX has prepared several solutions for operators to help in the event of an attack. One of them is EPINET. It is a ready-made internet access service to which the operator can temporarily switch traffic when its own addressing becomes a DDoS target. This does not solve all the problems – services running on their own IP addresses may remain unavailable – but it allows you to maintain basic Internet access for subscribers and gain time for further action. EPIX also provides test scrubbing mechanisms, allows you to quickly increase port bandwidth and has prepared a special path for handling reports related to attacks, so that they reach BOU as quickly as possible OVERNIGHT.

Ongoing cooperation is equally important. EPIX NOC monitors the network and sends notifications to operators about incidents related to spoofing and other threats, and the team remains available outside normal working hours, also in the evenings and on weekends. Additional mechanisms for communication with subscribers were also created, including the possibility of using low-cost SMS messages from an independent panel, and for AMS users the possibility of compiling a call after L2 was launched. 

In addition, there are closed information exchange channels, where operators can openly discuss the course of incidents and the effectiveness of individual defense methods. The scale of these activities was also positively assessed during meetings and webinars with representatives of UKE, where EPIX was indicated as an example of professional and comprehensive support for operators. 

It's worth asking this question: should every detail about a security incident be immediately released to the public? Sure, you can boost the reach of attacked operators, but will it end the DDoS wave? Since the saying goes, "what doesn't kill us makes us stronger," I propose a different idiom: "silence is golden." 

Censorship? Nothing could be further from the truth. Restraint is an expression of responsibility to those in the industry.    

Conversations are taking place. Not all of them are public.

TELKO.in's comment suggests that because industry event programs don't feature a significant number of DDoS-related topics, organizations have "distracted" themselves from the concerns of their members. In the case of the MiŚOT Group, this is difficult to agree with. 

Activities are carried out in cooperation with, among others, UKE and CERT Polska as part of working groups. MiŚOT Group has also started organizing industry meetings for local operators "Pizza with the Administrator", during which administrators can exchange experiences in a trusted group. These meetings are conducted in a workshop manner, and the topics discussed concern not only the analysis of attacks, but above all the development of ways to protect against further possible incidents. The third meeting of this series will take place on the second day of  the MiŚOT Congress in Nałęczów.

At the same time, activities are carried out at the organizational and legal level. Marcin Marciniak from the MiŚOT Group takes part in meetings with the Office of Electronic Communications and the Ministry of Digitization in Warsaw. Their aim is to analyze possible paths of action and to assess the potential consequences of the current wave of attacks for operators. A telecommunications development group was established, which meets periodically at the Ministry and discusses the problems of operators. The Office of Electronic Communications is preparing the necessary information and methods of contact, a narrow group of technical specialists will also be appointed to propose technical and organizational solutions to help prevent and eliminate the effects of similar attacks. Work is also underway on a change to the June recommendation on DDoS. The example of operators who did not pay the ransom and coped with the onslaught of the attack in a different way is also discussed.

The issue of current attacks was already discussed behind closed doors at the previous MiŚOT Congress. It was no accident. Participants were able to discuss specific incidents, configurations, and effective and ineffective defense methods without the risk of falling victim to an attack themselves a few hours later. 

During the next MiŚOT Congress in Nałęczów, the topic will appear again. On the second day of the conference, an expert debate on cybersecurity and attacks on operators will be held, attended by representatives of NERA, SkyPass Solutions, LiveSolutions and MiŚOT S.A., represented by Tomasz Brol, Vice President of the Management Board for Technical Affairs. The discussion will be led by Artur Tomaszczyk, associated with the MiŚOT Group. At the same time, another meeting from the "Pizza with the Administrator" series was planned.

Reducing institutional support to a "PDF with general guidelines" simplifies the problem. In the case of DDoS, the key question is not only what the CERT or the Central Bureau for Combating Cybercrime can do, but also how the operator collaborates with the node, the transit provider, and attack protection providers. It is at the intersection of these several elements that the fastest response can be achieved, information about the nature of traffic can be exchanged, and appropriate filtering mechanisms can be activated.

Ransom is not an anti-DDoS service

A separate comment is required regarding the presentation of paying the ransom as a solution that can be recommended to other operators, especially "if the amount is not excessive."

From the perspective of a single entrepreneur facing a multi-day paralysis, such a decision may be understandable. Customer pressure is growing, employees are exhausted, and every hour after that means real losses. But understanding motivation doesn't mean making it a good practice.

The payment does not guarantee the end of the attack. It also does not guarantee that the same entity will not return after a few weeks. Moreover, it confirms to the attackers that the selected business model works.

If knowledge about it begins to circulate publicly along with information about which companies pay, an additional problem arises. The operator ceases to be an accidental target for criminals, and may begin to be perceived as a payer.

Therefore, the industry's answer cannot be: "You have to know when to pay." It should be: you have to build infrastructure and procedures to minimize the chances of blackmail succeeding.

"Mr. Frog" sounds nice. The problem is not nice.

It's also worth considering the language we use to describe current events. The phrase "Mr. Frog" is undoubtedly memorable. The problem is that it can overly trivialize the situation.

We're not talking about a joker sending messages to operators just for fun. We're talking about activities that require infrastructure, technical expertise, preparation, target reconnaissance, and the ability to launch further attacks. If a specialized cybercriminal group is truly behind the campaign, it should be treated as such.

This is especially true given that the current threat landscape is significantly broader than just the DDoS wave targeting ISPs. In 2025, CERT Polska received 658,320 reports and recorded 260,783 unique security incidents, which is 152% more than the previous year.

In September this year, CERT Polska reported six vulnerabilities in MikroTik RouterOS. The combination of two of them allowed you to take full control of the device without authentication if the SSH service was available from the Internet. More importantly, CERT confirmed that such attacks are indeed already underway.

It's not about breaking the thermometer

There's no dispute about one thing: DDoS attacks on local operators are a serious problem and will likely remain so for a long time. Given the current geopolitical situation, it's unlikely that arresting one individual or even one group will put an end to the problem.

Cyber threats become an element of the normal functioning of the infrastructure. In August, the Supreme Chamber of Control assessed the safeguards of the eight audited operators of key services as insufficient and inadequate to the current nature of threats.

Small medium-sized operators also have to learn from this. There is no turning back from investing in resilience, redundancy, monitoring, response procedures and solutions to filter attacks outside your own infrastructure. It is also necessary to exchange knowledge, analyse incidents and hand over the material to CERTs and law enforcement authorities.

Therefore, the point is not to hang information on the door that the residents are not at home, which window does not close and where the spare key lies.