Cybercriminals are using everything from home routers and WordPress plugins to legacy directory services to launch a DDoS attack, which may explain why recent research shows instances of these attacks more than doubling over the past year.

Akamai recently published a report, titled “Q2 2015 State of the Internet – Security Report,” which showed the number of distributed denial-of-service (DDoS) attack incidents exceeding 100 Mbps has risen over the past quarter, along with those aimed specifically at the application or infrastructure layers of corporate IT environments. Perhaps most disturbing is the relatively low-grade channels cybercriminals have exploited to launch DDoS requests. Specifically, the research indicated cybercriminals are taking advantage of flaws in WordPress plugins or home routers owned by consumers, which could be harder for CISOs and their teams to track.

Experts told CSO Online that attackers are also increasingly looking at Tor, the network designed with anonymity in mind. Launching a DDoS attack this way would most likely do damage at the application level, but blocking all such anonymous traffic may mean organizations alienate legitimate customers, as well.

At the other end of the spectrum are more sophisticated cybercriminals, some of whom recently took advantage of RCS Portmapper, a relatively older Linux director service, to launch an advanced DDoS attack. Techworld explained the approach in detail: Portmapper was hit by Internet traffic that looked genuine but in fact led back to a malicious target. Though this technique was noticed after the fact, it’s a good reminder that legacy protocols may be more vulnerable to cybercriminals who know what they’re doing.

On the plus side, there seems to be equally strong efforts by government and law enforcement agencies to think of ways to better defend against a DDoS attack. SC Magazine reported that the U.S. Defense Advanced Research Projects Agency (DARPA) is working on a program called XD3, or Extreme DDoS Defense, which would not only recognize when servers were hit by malicious traffic, but also respond to the attacks within as little as 10 seconds.

Although this project may be initially piloted by military organizations, if it’s successful, large organizations may eventually get access to it, as well. Let’s hope so, because there is certainly no indication that these threats are going to fade away anytime soon.