NETSCOUT Records 9.1 Million DDoS Attacks in First Half of 2026
Report discovered via Awesome Annual Security Reports.
Summary
NETSCOUT recorded over 9.1 million DDoS attacks in 1H 2026. Attacks exceeding 1Tbps or 1Gpps rose 1,286% year over year, while direct-path methods and residential proxy sources complicated selective mitigation.
Key points
- NETSCOUT ATLAS observed 9,146,021 DDoS attacks across 209 countries and territories in 1H 2026, nearly a quarter more than a year earlier; its visibility covers two-thirds of routed IPv4 space.
- Attacks exceeding 1Tbps or 1Gpps reached 1,095, up 1,286% year over year. ATLAS also recorded its first IPv6 attack exceeding 1Tbps.
- Direct-path methods accounted for 64.40% of attacks. Carpet-bombing reached 4.54%, distributing traffic across destination addresses to evade per-host thresholds.
- DDoS-for-hire platforms increasingly advertise rate-based and mitigation-bypass methods. Attacks lasting one minute or less grew from 1.6% in 2H 2023 to 3.1% in 1H 2026; seller capacity and bypass claims remain unverified.
- ASERT linked residential proxy sources to DDoS activity using coordinated traffic behavior and backhaul tracking. It tracked 130 IPv4 backhaul addresses, which can help operators identify proxy nodes but do not themselves establish attack activity.
- TCP state manipulation and high packet or request rates can exhaust devices and applications before bandwidth is saturated. The report recommends selective scrubbing, prefix-level detection and remediation of attack sources.
- The observed service-provider mitigation rate remained roughly flat at 22.24%, meaning both mitigated attacks and attacks reaching their intended targets increased as overall volume rose.
Article Details
- Publisher
- NETSCOUT
- Report Period
- 2026-01-01 to 2026-06-30
- Scope
- Global DDoS telemetry across 209 countries and territories, 413 industry verticals, and 12,031 ASNs, supplemented by ASERT research and Arbor Cloud SOC observations.
- Sample Size
- 9,146,021 observed DDoS attacks; ATLAS visibility covered two-thirds of routed IPv4 space.
- Key Statistics
- Attacks exceeding 1Tbps or 1Gpps increased 1,286% year over year, from 79 in 1H 2025 to 1,095 in 1H 2026.
- Direct-path methods accounted for 64.40% of observed attacks in 1H 2026; reflection/amplification accounted for 35.60%.
- Carpet-bombing increased from 3.97% of observed attacks in 1H 2025 to 4.54% in 1H 2026.
- Service providers mitigated 22.24% of observed attacks in 1H 2026, compared with 23.12% in 1H 2025.
- Attacks lasting one minute or less increased from 1.6% of observed attacks in 2H 2023 to 3.1% in 1H 2026.
- Recommendations
- Provision dedicated edge scrubbing capacity with selective mitigation and headroom for concurrent incidents, routine peaks, and maintenance windows.
- Deploy on-premises mitigation near enterprise-operated services, complemented by cloud mitigation for distributed attacks, overflow, and events exceeding local capacity.
- Use aggregate netblock detection thresholds to identify carpet-bombing that remains below individual host thresholds.
- Detect and suppress coordinated outbound and transit attack traffic while preserving unaffected subscriber traffic.
- Identify and remediate botnet nodes, residential proxy nodes, and open reflectors or amplifiers using source address validation, traffic analysis, backhaul tracking, and an operational abuse-response process.
MITRE ATT&CK
T1498.001 · Direct Network FloodThe report documents direct-path network flooding, including a 3.5Tbps UDP flood against a hosting provider and widespread TCP floods.T1498.002 · Reflection AmplificationReflection/amplification represented 35.60% of observed attacks; reported methods included DNS, STUN, NTP, SSDP, and memcached.T1499 · Endpoint Denial of ServiceAttack methods exhausted connection state in firewalls, load balancers, and NAT devices, or overwhelmed application backends and session handling without necessarily saturating network links.
People
Malware
AisuruOperators associated with Aisuru, Kimwolf, Jackskid, Mossad, and their successors have raised the attack-generation capacity of individual nodes, so fewer compromised devices are needed to reach a given attack size.JackskidOperators associated with Aisuru, Kimwolf, Jackskid, Mossad, and their successors have raised the attack-generation capacity of individual nodes, so fewer compromised devices are needed to reach a given attack size.KimwolfOperators associated with Aisuru, Kimwolf, Jackskid, Mossad, and their successors have raised the attack-generation capacity of individual nodes, so fewer compromised devices are needed to reach a given attack size.MossadOperators associated with Aisuru, Kimwolf, Jackskid, Mossad, and their successors have raised the attack-generation capacity of individual nodes, so fewer compromised devices are needed to reach a given attack size.
Vendors
Products
Arbor Cloud- [A View from the Arbor Cloud SOC](#a-view-from-the-arbor-cloud-soc)Arbor Threat Mitigation Systems (TMS)Network controls and dedicated intelligent DDoS mitigation systems, like NETSCOUT's Arbor Threat Mitigation Systems (TMS), do different jobs.AtlasThis report draws on NETSCOUT’s ATLAS global threat intelligence, original ASERT research on DDoS-for-hire platforms and residential proxy networks, and operational observations from the Arbor Cloud Security Operations
Industries
broadbandOutbound attacks clearing 1Tbps or 1Gpps caused operational impact for broadband and mobile operators worldwide in 1H 2026, and at that scale the traffic can degrade the originating or transit network before it reacheshosting> We see the same pattern. In one case a 3.5 Tbps UDP flood targeted a hosting provider. Attacks at that scale are almost always short, typically no more than one to two minutes, and this one ran two minutes. All of themobileOutbound attacks clearing 1Tbps or 1Gpps caused operational impact for broadband and mobile operators worldwide in 1H 2026, and at that scale the traffic can degrade the originating or transit network before it reachesSaaS> A SaaS provider was hit with a significant carpet-bombing event, and the Adaptive DDoS Protection capabilities in the solution were crucial. Per-host thresholds alone would have missed it, since the attack stayed