DDoS Attack Growth Accelerates, Overwhelming Defenses Before Bandwidth Saturation
Netscout's latest report indicates a 24% year-over-year surge in DDoS attacks, with massive increases in high-volume assaults that exploit network equipment vulnerabilities.
Global Distributed Denial of Service (DDoS) attacks have seen a significant surge, with over 9.1 million incidents recorded in the first half of 2026. This represents a nearly 24% increase compared to the same period last year, according to NETSCOUT's DDoS Threat Intelligence Report. The escalating volume and sophistication of these attacks are straining traditional defense mechanisms and highlighting new attack vectors.
A particularly alarming trend is the dramatic rise in large-scale attacks. Incidents exceeding 1 Terabit per second (Tbps) or 1 Billion Packets per second (Gpps) have surged by an astonishing 1,286% year-over-year. This growth is largely attributed to botnets such as Aisuru, Kimwolf, and their successors, indicating that attackers now require fewer compromised devices to launch highly impactful assaults. This shift means that defenses can be overwhelmed before network bandwidth is fully saturated.
"With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient," stated Hardik Modi, VP Engineering, DDoS Solutions, and ASERT Threat Intelligence Team at NETSCOUT. "Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts in attack sophistication."
Many of these attacks overwhelm critical network infrastructure like firewalls and load balancers with an immense volume of packets, requests, and connections. This resource exhaustion can occur even before the network's available bandwidth is fully utilized. In some cases, attacks delivering billions of packets per second have overwhelmed individual router components, known as line cards, particularly where protective measures were absent. The failure of these components can lead to widespread service disruptions, affecting networks and customers beyond the direct target.
While IPv6 accounted for a similar share of observed attacks as the previous year, these attacks became more demanding. NETSCOUT's ATLAS system recorded its first IPv6 attack exceeding 1 Tbps in the first half of 2026, and active mitigation efforts for IPv6 attacks increased by over 300%. Direct-path attacks, where traffic is sent straight to a target, constituted 64.4% of observed attacks, marking a continued upward trend. Carpet-bombing attacks, which spread traffic across numerous destination addresses within a network prefix, also saw an increase, rising from 3.97% to 4.54% of observed attacks.
DDoS-for-hire platforms continue to lower the barrier to entry for malicious actors. These services offer subscription plans, free trials, and pre-configured attack methods, significantly reducing the technical expertise required to launch an assault. Many of these platforms promote methods claiming to bypass specific defenses, often emphasizing packet, connection, and request rates over bandwidth alone. Attacks lasting one minute or less have doubled their share, now representing 3.1% of observed incidents, though longer attacks still dominate.
The increasing use of residential proxies complicates detection efforts. These networks route traffic through consumer devices, making malicious traffic harder to distinguish from legitimate user activity. Attackers leverage these proxies, sometimes through apps installed without explicit user consent, to launch attacks. The dynamic nature of IP addresses in residential networks and the frequent switching of proxy nodes make address-based blocking unreliable. Defenders are increasingly relying on identifying coordinated behavior and tracking the stable backhaul systems used by proxy clients to detect and suppress attack traffic.
In response to these evolving threats, service providers are urged to enhance their dedicated filtering capacity at network edges, while enterprises need protection closer to their services. Broad blocking measures can inadvertently disrupt legitimate customers, necessitating more granular and selective mitigation strategies. The report underscores the need for continuous adaptation in defense strategies to counter the growing scale and sophistication of DDoS attacks.