Netscout's DDoS Threat Intelligence Report, covered by Help Net Security, counts 9.1 million DDoS attacks in the first half of 2026, about a quarter more than the same period last year. The sharpest growth is at the high end: attacks exceeding 1 Tbps or 1 Gpps rose 1,286% year over year, with much of that activity attributed to botnet operators using names such as Aisuru, Kimwolf, and Jackskid.
The report highlights a qualitative shift. Many attacks are designed to exhaust firewalls, load balancers, and router line cards with enormous packet, request, and connection counts, rather than fill a target's internet link. In some cases, billions of packets per second have disabled individual line cards, disconnecting customers and networks that were not the intended target. Direct-path attacks accounted for 64.4% of observed attacks, and IPv6 attacks, while a similar share overall, became more demanding, including the first IPv6 attack over 1 Tbps.
DDoS-for-hire platforms make this easier. Subscription plans, free trials, and preconfigured control panels let users launch attacks with minimal technical skill, and most reviewed services defaulted to a single 60-second attack with a free method. Attacks lasting a minute or less grew from 1.6% of incidents in late 2023 to 3.1% in the first half of 2026, though longer attacks remain the majority. Some sellers claim their methods bypass specific defenses, but those claims are not independently verified.
Residential proxy networks add another layer. Because proxy customers cycle through home and mobile IP addresses, address-based blocking is unreliable. The report suggests defenders look for coordinated behavior, such as sources contacting the same destination or changing traffic rates together, and track backhaul systems used by proxy clients, since those addresses can remain stable for weeks or months. Providers are also urged to push dedicated filtering capacity closer to network edges and enterprise services rather than relying on coarse controls.