The New DDoS Economy: Bigger Attacks, Better Sources, Lower Barriers

The first half of 2026 did not produce a breakthrough distributed denial-of-service (DDoS) attack technique. Instead, it revealed something more consequential: the industrialization of existing attacks. Attackers are no longer competing primarily on bandwidth. They are competing on delivery, source quality, and operational efficiency.

DDoS-for-hire platforms now market attack methods designed to bypass specific defenses, residential proxy networks supply source addresses that resemble legitimate users, and high-impact attacks exceeding 1Tbps or 1Gpps have become dramatically more common. Meanwhile, attack frequency continues to rise, pushing providers and enterprises toward a new operational baseline.

More than 9.1 million DDoS attacks were observed globally during the first half of 2026, highlighting a threat landscape where familiar attacks have become larger, easier to acquire, and harder to distinguish from legitimate traffic. Nearly half of all DDoS attacks now use multiple attack vectors, allowing adversaries to combine volumetric, protocol, and application-layer techniques in a single campaign. This increases pressure on defenders by requiring coordinated mitigation across multiple attack types rather than a response to a single threat vector.

Together, these shifts are driving the need for defenders to adopt more intelligent DDoS protection solutions that can distinguish malicious activity from legitimate traffic and respond selectively.

More Than 9.1 Million DDoS Attacks Observed

NETSCOUT ATLAS observed 9,146,021 DDoS attacks during the first half of 2026 across 209 countries and territories, impacting 12,031 autonomous system numbers (ASNs) and 413 industry verticals. ATLAS visibility now extends across roughly two-thirds of routed IPv4 space and more than 800Tbps of peak traffic traversing protected network edges.

Attack frequency continued its upward trajectory, with daily attack counts increasing by nearly one quarter compared with the first half of 2025. More importantly, the increase accelerated across successive reporting periods, indicating that elevated attack activity has become part of the operational baseline rather than a temporary spike.

High-Impact Attacks Surge 1,286 percent

One of the most significant findings in the report was the dramatic increase in high-impact attacks. Attacks exceeding either 1Tbps or 1Gpps increased 1,286 percent year over year. The number of these attacks rose from 79 in 1H 2025 to 167 in 2H 2025 before surging to 1,095 in 1H 2026.

Rather than focusing solely on bandwidth, many of today’s largest attacks emphasize packet rates, connection rates, query rates, and transaction rates that target stateful infrastructure. These attacks can exhaust connection tables in firewalls, load balancers, network address translation (NAT) devices, and application infrastructure before network links approach saturation. The significance is not simply their size; these attacks are increasingly engineered for delivery quality and to bypass basic defenses.

NETSCOUT’s Arbor Cloud security operation center (SOC) observed firsthand how these attacks are unfolding in production environments. In one instance, a 3.5Tbps UDP flood targeted a hosting provider and lasted approximately two minutes. The attack was fully mitigated without customer-visible impact or collateral effects on other customers sharing mitigation resources.

IPv6 Attacks Reach a New Milestone

While IPv6 maintained a relatively stable share of overall attacks, two developments stand out. ATLAS recorded its first IPv6 DDoS attack exceeding 1Tbps, and active mitigation of IPv6 attacks increased by more than 300 percent year over year.

Historically, much IPv6 attack traffic was generated incidentally by dual-stack botnets targeting hostnames that resolved to both IPv4 and IPv6 addresses. The sharp increase in active mitigation activity suggests more deliberate targeting of IPv6 infrastructure and greater operational impact on production environments.

Direct-Path Attacks Continue to Gain Ground

The structure of DDoS attacks also continues to change. Direct-path attacks represented 64.4 percent of all observed attacks in 1H 2026 and gained share for the third consecutive reporting period. Reflection and amplification attacks accounted for the remaining 35.6 percent.

This trend matters because direct-path attacks are typically more difficult to address with coarse network controls. Reflection attacks can often be described by a relatively small rule set, while direct-path attacks frequently require selective inspection and mitigation to distinguish malicious traffic from legitimate demand. As direct-path attacks gain share, mitigation systems increasingly need the ability to inspect, divert, and selectively suppress attack traffic without disrupting customer services.

Carpet-Bombing Remains on the Rise

Carpet-bombing attacks continued their steady growth during the first half of 2026 with a 14 percent increase over 1H 2025. Unlike traditional attacks that focus on a single host, carpet-bombing distributes traffic across a large number of addresses within a prefix. Individual hosts may remain below detection thresholds even while aggregate traffic reaching the network edge becomes operationally significant. This makes traditional per-host detection and mitigation strategies less effective.

The Arbor Cloud SOC reported mitigating a significant carpet-bombing attack against a SaaS provider where per-host thresholds alone would not have detected the event. Detection across the entire netblock enabled mitigation before the customer’s /24 became saturated. Two additional incidents targeting the same customer occurred within the same week and were mitigated without customer impact.

DDoS-for-Hire Continues to Mature

ASERT’s review of DDoS-for-hire platforms found a market that increasingly resembles commercial software rather than underground tooling. Services commonly provide professional storefronts, free trials, tiered subscriptions, cryptocurrency payments, APIs, command-line clients, and extensive attack catalogues.

Several trends emerged from the research:

• Attacks are increasingly sold based on delivery and effectiveness rather than raw bandwidth.
• Attack methods are marketed against specific defenses and platforms.
• Rate-based attacks and bypass techniques have displaced bandwidth as the primary sales metric.
• Most storefronts appear to rely on a relatively small number of shared underlying platforms.
• Source address quality has become a key differentiator.

Residential Proxies Become Part of the Attack Supply Chain

The report also highlights growing evidence that residential proxy infrastructure is participating in DDoS activity. ASERT combined residential proxy tracking with DDoS telemetry to identify proxy sources participating in attacks.

Residential proxy networks route traffic through consumer devices connected to residential and mobile access networks. Because these addresses appear legitimate, they present a significant challenge for traditional reputation-based defenses. Rather than focusing on individual addresses, ASERT identifies coordinated behavior patterns, including synchronized traffic shifts, common protocol behavior, convergence on shared targets, and connections to supporting backhaul infrastructure.

Research also found that modern attack services increasingly emphasize access to residential source addresses. Providers advertise large pools of IP addresses and selectable geographies because source quality has become critical for attacks intended to blend into legitimate traffic flows.

What It Means for Defenders

The findings from 1H 2026 point to a clear operational reality: Preserving service availability increasingly requires more than bandwidth and coarse filtering. Direct-path attacks, multivector attacks, carpet-bombing techniques, rate-based attack methods, and residential proxy sourcing all place greater emphasis on selective mitigation.

For service providers, this means maintaining sufficient intelligent mitigation capacity to detect, divert, inspect, and selectively suppress attack traffic while preserving legitimate services. For enterprises, it reinforces the need for on-premises protection close to critical services. Cloud-delivered mitigation remains an important complement for distributed attacks, overflow situations, and events that exceed local capacity.

The overarching lesson from the first half of 2026 is not that a new DDoS technique has emerged. Rather, familiar attack methods have become larger, easier to acquire, and more difficult to distinguish from legitimate activity. As those trends continue, defenders must increasingly focus on preserving service under attack, not simply containing malicious traffic.

Read the full DDoS Threat Intelligence Report.