Since mid-February, security researchers and network administrators have observed a significant spike in distributed denial-of-service (DDoS) attacks originating from user datagram protocol (UDP) port 10074, targeting “ISPs, financial institutions, logistics companies, gaming firms, and other organizations.” Researchers from multiple firms have identified threat actors exploiting a critical vulnerability in-the-wild within the Mitel MiCollab business phone and MiVoice Business Express collaboration systems. These Mitel products function to provide Internet-based site-to-site voice connectivity for Private Branch Exchange (PBX) systems, which operate with Voice Over Internet Protocol (VoIP). The vulnerability has been named “TP240PhoneHome” (tracked as CVE-2022-26143), due to a flaw in the TP-240 VoIP-processing driver, which is supposed to operate as a secure bridge that is not supposed to be exposed to the internet. A researcher from Akamai states that many of these Mitel PBX-to-Internet gateways were configured incorrectly, exposing them to the public Internet. This new reflection/amplification DDoS attack method is significant due to its record-breaking potential amplification ratio of 4,294,967,296:1, and its ability to conduct a sustained attack of up to fourteen hours, leveraging as much as 53 million packets per second (PPS). According to the joint advisory, approximately 2,600 Mitel systems have been deployed and configured incorrectly. On Tuesday February 8, 2022, Mitel released software updates that disable internet access to the TP-240 VoIP-processing driver, however if critical business processes can’t be stopped at this time, standard DDoS defense techniques and tools would mitigate this attack. The Ankura CTIX team will continue to report on novel attack methods, and further fallout from the TP240PhoneHome vulnerability will be reported on in updates if necessary.