State under siege: How Estonia stopped Russia’s DDoS campaigns

I think it's going to be a really interesting conversation. So I'm Jacob Crisp, Cloudflare. We've got a great lineup today, but I wanted to kind of give a little bit of context to set the scene since we've got, you know, 30, 40 minutes to talk about it. The scope of today's conversation is around the Estonian CERT team and their work to defend against Russian nation state actors and a bunch of other things. What's interesting to remember with, you know, historical context with Estonia is they've spent a decade plus really digitizing their entire economy, making system health care services. It's a digital native country. So you can imagine a lot of these topics are absolutely existential for them all from a citizen perspective and a societal perspective to maintain resilience in the face of a cyber adversary that's quite strong. Right. So the scope of today is sort of walking through some of those issues, exploring kind of the details of what they're seeing and then talking more about a bit. So over to Brian. Yeah. Hi, I'm Brian Carter. I'm the director of cybercrime research at Cloud Force One and had the pleasure to visit Estonia earlier this year and attend the CERT conference where I learned a lot about the unique issues that are relevant to Estonia. And I'm happy to have them here with us today to talk about all of their important work on the front line of protecting Estonia's infrastructure. Yeah. Hi, I'm Jauhm Tome. My name is Jauhm Tome. And we work at CERT -EE, Estonia's National Cyber Incident Response Team, which is part of the Information System Authority, RIA for short. Together, we run the web application firewall team, which protects most of Estonia's public sector online. And in the presentation, we'll explain why the defence comes first in a digital country. And we'll show how we put the public sector behind one shield. I'll start off with a little bit about Estonia. Since 2024, every state service in Estonia can be done online. You can get married or divorced online. Divorce was the last one to go online. So when I say the state runs online, I literally mean it. Your ID card can sign documents. Taxes take a few minutes, if even that. Your doctor writes a prescription. You can pick it up at any pharmacy. You can vote online, of course. You can register a company before your coffee gets cold. Behind all of it is the government agency's exchange data over our X road. That changes what an outage means. In most countries, a government website going down is annoying. In Estonia, it means people can't sign, can't file, can't get their medicine or can't get into their banking systems. So the state literally stops working if something goes down. So for us, defence isn't just an add-on to a digital state. It's a crucial part of it. RIA has a really nice slogan for this. And I'll say it in Estonian first. On a good day, we're invisible. Every day, we're irreplaceable. So a good day for us is a day when people can see that we have blocked an attack and they can just use their services. But this isn't new for Estonia. CERTI was founded in 2006. A year later, 2007, Estonia became the first target of cyber attack on a national scale. Government agencies, banks, media sites were knocked offline. Some were knocked online for a whole week. The attack changed how Estonia thinks about security. Me and Jurgen were kids back then, so I won't kid you that we know the details, but we know the system that grew out of it. The lesson from it was simple. Being digital and being defended are the same job. Since then, the attackers have changed, but the reasons they attack haven't. So who attacks us? Since 2022, since the war in Ukraine, we have been the target mostly by pro-Russian groups, the best known being NoName065, 06Sensor. Their model is actually quite clever. They run a telegram channel and they hand over a tool called Tasia. So when a volunteer downloads it, it downloads the script. Their home computer becomes a part of a botnet. And when the C2 server gives them the list, the whole botnet starts attacking. Estonian sites are usually one of the targets. Since 2025, pro-Palestinian groups have started to join in too, but they have been mostly helping the pro-Russians in attacks that the pro-Russians have started. But why us? Why Estonia? We get hit whenever we take a public stand. In 2007, it was moving a controversial Soviet-era monument from a central location in the city to somewhere else. Since 2022, it was our adamant support for Ukraine. And a country that runs online is a very visible target. But what do these hacktivist groups need? They primarily need visibility. A screenshot of a site that's taken down, posted on a telegram. The screenshot itself is the propaganda. And it's also how volunteers prove how good they are at attacking. Because the most active ones, the most active attackers get paid in crypto and climb leaderboards. No screenshot, no story, no payout. Keep that in mind that this comes back later. So these are the official figures RIA has published. In 2021, we recorded just 75 DDoS attacks. Last year, it was 756. A tenfold increase in five years. The orange part in the graph shows the attacks that actually had any impact. So service disrupted somewhat, taken down whole. In 2021, over a half of the attacks had had some impact. Last year, it was around 12%. The blue marker on the graph shows when we adopted Cloudfire's WAF. So at the beginning of the war, we didn't have it. We deployed it a couple months into the war. But after the start of the war, we have been targets of the attacks and the attacks have been just rising in volume. But thankfully, thanks to Cloudfire's WAF, the impact has just kept on falling. But I'd like to caveat the graph with the fact that these numbers are DDoS attacks against Estonian entities. So this includes network layer attacks, like attacks against DNS servers and attacks against websites that are not under our umbrella. To understand why we had to change our tactic protecting Estonia, let's look at how things were before we implemented this shield. Before, every ministry, agency, municipalities, everyone had to protect themselves. So all the big IT houses, ministries, they all did the DDoS protection and hosting themselves. The smaller ones, like municipalities, they had to just rely on whatever DDoS protection the host could provide them. When an attack came, SERTI collected the indicators, which were mostly just IP addresses, and shared them to our agency's IT houses. And then each host had to apply their plugs by hand whenever they had the chance to do it. By the time a list arrived to these guys, the botnet had already moved on to new IPs. So we were always reacting. Every organization was fighting the same battle, but separately. So in May 2022, three months into the war, we changed models. We built a WAF as a service, on Cloudflare, run by SERTI for the public sector, free of charge for the public sector. Agencies didn't have to move anything. Their servers stayed where they were. They just had to point their hosts toward us. Today that means over 800 hosts. Most, not most, all of the main IT houses, agencies and most important services are all behind the Cloudflare WAF. The key number on this slide is the number one. One rule change protects everyone now. When we learn about something new from an edsac on one ministry, the tax board, police and every other client gets protected when we implement that rule. So how do we run it with such a small team, the two of us? We keep central control. SERTI owns the security rules for every client, which keeps it consistent and fast. But central control only works when people trust it. So every agency can see what can see their own traffic, what we block for them. We show it through our own client portal, where they can see what has happened, so they know they can trust the service. The next step for us is Cloudflare organizations. So the idea is every agency or a bigger client gets their own Cloudflare account and self-service views. So that's in progress for us, but that's the ideal. So they could change anything if they wanted themselves. And now I'll hand it off to Juergen. Yeah, let's talk a little bit about the adversaries themselves. The funny thing is about activists that for them to conclude an attack successful, they really want to see the webpage go down. So they want to take a picture actually and post it on Telegram. And what they do is they use publicly online tools to check whether a host is up or down. And this gives us a pretty good indicator. We already have seen multiple times what tools they use. So we log them, we see them before the attacks and during the attacks. So this gives us a little heads up, some numbers here. In autumn, 10 out of the 14 attacks that were considered bigger for us. These are not all of the attacks, but some of the attacks that we actually analyzed. 10 of the 14 had this check before the attack. So this gives us a pretty good percentage-wise indication. And what we can do with that is we can warn the agencies, we can tighten up our WAF rules, we can tighten up our rate limits. But obviously every agency, not everyone, but some of them use the tools themselves. So context matters. And fortunately, we have pretty well figured out which tools they use and when they use them. So we have a pretty good advantage when it comes to DDoS attacks. So let's see what happens when they actually get a screenshot. This was one of the bigger ones. The 3 billion requests were actually in a couple of hours, not a day. This is a mistake. A pro -Kremlin activist group targeted dozens of public websites. So we have over 3 billion malicious requests in a little time span. The heaviest wave came in the afternoon. It was for the police, border guards, tax and customs, and Ministry of Justice. And those attacks had an impact, but the impact was that the three of these sites mostly slowed down and had brief disruption, and then it was mitigated. And that's what our shield is actually for. The attacks tried to cover multiple dozen of websites and three bigger ones that actually were hit the most were the only ones that had a brief disruption. And one change from our team protected all of them. So they don't have to do this themselves, or everyone doesn't need to figure out what is hitting them. Only a central team can help them all at once. And volume is one way to attack. Recently, they tried something else. On the left, we have the state login service. This is called Tara. In Estonia, when someone tries to log in to a governmental e -service with their ID card or mobile ID or smart ID, whichever one, it goes through that website. And if you take this down, you take down a whole bunch of services so users can get authenticated to it, whether it be medical documents or whatever you're trying to file customs, there's many, many different websites. So this is a good place to aim an attack. This happened on the 11th of September. And 13 minutes within the attack, there was the first post in the telegram on the right, which stated there's a picture of an error page of the state login site. And the adversary said the attack duration is going to be three hours. The attack itself was almost one hour long. It had 80 million requests during that time. At peak, it was nearly 5 million in a minute, from all kinds of different countries we have on this earth. And for about 45 minutes was the actual disruption. So, which we saw from the error rates and logins. The error rate went down from almost nothing to under 3%. So most requests still went through, and within the hour, it was over. And they claimed three hours. So it was actually a 45 minute partial disruption. And that's their best screenshot of the year. And it's mostly fiction. So yeah, how do we deal with these attacks? 82,000 addresses are quite a lot to block by hand. But fortunately, we have signatures. And every connection has a handshake. And the handshake shows what software is making it. So a J4 fingerprint, for this example, is that handshake. And these addresses that attack us can change constantly, but the software that they use rarely changes. Well, not rarely, but it's mostly the same, as we've seen. So yeah, these 82,000 addresses only had 13 fingerprints, which is actually quite a lot in our experience. Usually there's only a couple of them. So this was a pretty good attack in that sense. You can't block the 82,000 IPs, but you can block the 13 handshakes. And as we've witnessed from that attack, from September, out of the seven attacks, six times the same fingerprint came back. So every way was in some sense easier for us. Before the J4 was even available to us, we had asked Outfair for it. They had it internally. And within days we had it too. So that's a good partnership moment, I guess. I'm not even sure whether it came out for everybody or that was like a special request. I don't think so. So yeah, a fingerprint identifies software, not a person. And the normal browser can also share this fingerprint. So usually we take some other indicators like detection IDs of Cloudflare themselves or some user agents, and we block a combination of those not to disrupt the normal traffic. And yeah, let's see what happens when the attacks mostly just don't work for us mainly. Hacktivists do want a disruption. They want a screenshot. If there's no screenshot, there's no attack for them pretty much. And the best defense against the attacks is to be as boring as possible. So we really try to be invisible, not to give them any reaction. And in autumn, we looked closely to 14 attack waves on the public. Most were over about six minutes. Only one, the login attack you saw, caused anything actually noticeable for us. And even that was partial. So they mainly move on, or at least we've seen in recent times that their channels have victories of other countries, states, portals or whatever websites. Estonian ones rarely show up here. And as I said, the best defense against them is to be as boring as possible. Obviously, we're not perfect. Estonia as a whole, this service we provide is voluntary, so people don't have to come under us. We have over 800 websites currently, so that's a pretty good statistic for us, especially as we're a small country. And the websites that aren't behind our protection, the attackers do find them. And we usually see that the people who were hit only come to us after they've been hit. So it's a good indicator that we actually provide something of value for them. Obviously, the attackers themselves, they adapt. It's an ongoing process all the time. J4 fingerprints, they become obsolete. Sometimes they do scraping instead of flooding, as our websites maybe don't expect that much traffic. So scraping can slow them down too. We have to watch out for that. Today, a lot of our shield lives in the dashboard. We plan on moving and using Terraform, so each agency gets its own possible way to push their own configuration, stay up to date, have more hands-on experience. Currently, this is only up to us, mainly, and some requests from the clients that we also do for them. The clients push their configuration up, we review it, and then it gets applied. And we obviously keep the main central baseline WAF rules, so one move can be applied to every one of them. So if you're another country or a larger organization, what can you copy from us? Mainly, it's good to centralize the protection, gather the indicators, keep them up-to-date, update them, check out what tooling is the attacker using, update those, log them. Blocker has a good feature of logging all kinds of different traffic, which can give you an indication of maybe the next attack. Also, it helps to give your clients visibility. Also, it needs to be a partnership. If you're providing such a service that you don't really know the intricacies of each application you're protecting, you need their insights of which endpoints it's important to protect, which can be hit the hardest, whether it's a login page or a, I don't know, file sharing system, that could be hit the most. So yeah, it's a partnership between us. And yes, watch the attackers tooling and ask your vendor whether it's Cloudflare or anyone else. Maybe one day when J4 becomes obsolete, we have the next best thing. Yeah, but thank you.