Flare Finds DDoS-for-Hire Ads Rose Tenfold as Services Become More Commercialized

Summary

Flare compared underground DDoS activity from early 2023 and 2026, finding roughly ten times as many high-signal service ads. The ads increasingly promote packaged platforms, automation, support, pricing tiers, and reseller options.

Key points

Flare compared DDoS-related underground activity from the first five months of 2023 and 2026; high-signal service ads rose from 38 to 364.
The comparison also found unique ad clusters increased from 31 to 123, actors from 15 to 41, and observed sources from 22 to 43.
Ads in 2026 more often presented DDoS services as packaged products with panels, API access, monthly plans, customer support, and reseller options.
Advertised prices ranged from $5 tests and short attacks to premium offerings; these are seller claims, not verified service capabilities.
Flare noted that sellers may exaggerate capabilities, but the consistent marketing around automation, bypasses, and ease of use provides intelligence on what they promote to buyers.
Cloudflare reported mitigating attacks of 7.3 Tbps and 31.4 Tbps in 2025; Microsoft attributed a 15.72 Tbps Azure attack in October 2025 to the Aisuru botnet.

Article Details

Publisher: Flare (sponsored content published by BleepingComputer)
Report Period: First five months of 2023 and first five months of 2026
Scope: Comparison of underground DDoS-related activity; the research focused on DDoS offerings and sought to exclude DoS offerings.
Sample Size: 4,403 records for the 2023 period and 4,964 records for the 2026 period
Key Statistics: High-signal DDoS service ads increased from 38 in the first five months of 2023 to 364 in the first five months of 2026 (~10x).
Unique ad clusters increased from 31 to 123 across the two periods (~4x).
Unique actors increased from 15 to 41 across the two periods (~3x).
Sources observed increased from 22 to 43 across the two periods (~2x).