Cat and Mouse: Web Attacks Increasingly Sidestep WAF Protections

This Akamai analysis describes a distributed “slow and low” brute-force campaign against nearly 500 WordPress applications in which a botnet coordinates low-volume login attempts from many IPs to evade WAF rate controls; the report explains the attackers' tactics, the persistence and scale of the campaign, and recommends holistic/cloud WAF visibility and IP reputation/threat intelligence to detect and mitigate such attacks.