Akamai Reports 113% Rise in API Attacks as Application and DDoS Threats Converge
Report discovered via Awesome Annual Security Reports.
Summary
Akamai’s 2026 report says average daily API attacks rose 113% in 2025, while Layer 7 DDoS attacks increased 61%. Its telemetry shows a shift toward API workflow abuse, underscoring the need for integrated application security and multilayer defenses.
Key points
- Akamai reports that average daily API attacks per enterprise increased from 121 in 2024 to 258 in 2025, a 113% rise.
- Unauthorized workflows and abnormal activity accounted for 61.18% of observed API attacks in 2025, up from 30.01% in 2024, indicating a shift toward business logic abuse.
- Security misconfiguration represented 39.61% of observed API weaknesses, followed by broken object property level authorization at 35.11% and broken authentication at 18.56%.
- Customers averaged 3,000 APIs containing sensitive data; approximately 12% had security weaknesses, and 24% of those weaknesses concerned sensitive data exposure.
- Layer 7 DDoS attacks increased 61% year over year in 2025 and 104% between 2023 and 2025. The report highlights Aisuru and Kimwolf botnets as enablers of accessible DDoS-for-hire services.
- Web attacks against applications and API endpoints increased 73% between 2023 and 2025. Akamai observed nearly 65 billion such attempts in APAC during 2025, up 23% year over year.
- The report recommends integrated application and API protection, complete API inventories, authentication and authorization testing, runtime behavioral monitoring, and regularly tested DDoS defenses across Layers 3, 4, and 7.
Article Details
- Publisher
- Akamai
- Report Period
- 2024-01-01 to 2025-12-31
- Scope
- Global API security, web application attacks, and Layer 3, 4, and 7 DDoS telemetry, with regional analysis of APAC, EMEA, and Latin America. Application-layer alerts do not establish attack success; API incidents include activity scored as suspicious.
- Key Statistics
- Average daily API attacks per enterprise increased from 121 in 2024 to 258 in 2025, a reported 113% increase.
- Behavior-based threats involving unauthorized workflows and abnormal activity accounted for 61.18% of API attacks in 2025, compared with 30.01% in 2024.
- In 2025, customers averaged 3,000 APIs containing sensitive data; approximately 12% showed security weaknesses, and 24% of those weaknesses concerned sensitive data exposure.
- Layer 7 DDoS attacks increased 61% from 2024 to 2025 and 104% between 2023 and 2025.
- Web attack volume against applications and APIs increased 73% from the beginning of 2023 through the end of 2025.
- Recommendations
- Maintain a complete API inventory, including shadow and deprecated endpoints, and identify APIs that expose sensitive data.
- Combine WAF protection with dedicated API behavioral detection, lifecycle testing, and runtime monitoring of authentication, authorization, and data handling.
- Integrate DDoS mitigation, WAF, API security, bot and abuse prevention, and identity-aware controls, with protection across Layers 3, 4, and 7.
- Define incident decision-makers, escalation paths, vendor SLAs, and response playbooks; test playbooks at least biannually and conduct realistic DDoS simulations.
- Automate DNS asset discovery, remove unused records, continuously detect configuration drift, enforce strong access controls and DNSSEC, and monitor certificate lifecycles.
MITRE ATT&CK
T1110.004 · Credential StuffingThe report identifies credential stuffing, amplified by AI-powered bots, as a prominent online fraud threat in Latin America.T1190 · Exploit Public-Facing ApplicationTwo Mirai botnets reportedly exploited a remote code execution vulnerability in exposed Wazuh servers through unsanitized JSON in API requests.T1498.001 · Direct Network FloodThe report describes direct high-volume network floods, including UDP, SYN, and ICMP traffic, launched by servers and botnets.T1498.002 · Reflection AmplificationThe report identifies amplified DNS and NTP reflection floods as network-layer DDoS methods.T1499.003 · Application Exhaustion FloodApplication-layer campaigns use HTTP GET/POST floods to exhaust CPU and memory on application servers, APIs, and websites.
People
Brent MaynardAkamai Senior Director for Cybersecurity Strategy who contributed analysis of attack economics and the convergence of application, API, and DDoS threats.Domingo PonceAkamai Senior Director of Security Operations quoted on the persistence and evolution of Mirai botnets.Reuben KohAkamai Director of Security Technology, APJ, who contributed analysis of API, AI, web attack, and DDoS risks in APAC.Richard MeeusAkamai Senior Director of Security Technology & Strategy, EMEA, who contributed analysis of operational resilience, supply chains, and regulation.Steve WinterfeldAkamai Advisory Chief Information Security Officer who contributed guidance on agentic AI threat modeling and defensive controls.
Threat Actors
CARRNamed among aggressive hacktivist groups conducting large-scale disruption campaigns.DieNetNamed among aggressive hacktivist groups conducting large-scale disruption campaigns.NoName057(16)Hacktivist group described as conducting high-frequency DDoS disruption campaigns intended to generate media attention.QilinRussia-linked RaaS group, also known as Agenda, reported to have added DDoS capabilities. The report states that many RansomHub affiliates joined it in Q2 2025.RansomHubRansomware operation whose collapse reportedly preceded many of its affiliates joining Qilin in Q2 2025.
Malware
Aisuru- Layer 7 DDoS attacks surged by 104% over the last 2 years (2023–2025). Super botnets like Aisuru and Kimwolf (TurboMirai variants) enable accessible DDoS as a service, making sophisticated attacks available to anyone.Kimwolf- Layer 7 DDoS attacks surged by 104% over the last 2 years (2023–2025). Super botnets like Aisuru and Kimwolf (TurboMirai variants) enable accessible DDoS as a service, making sophisticated attacks available to anyone.MiraiThe malware known as Mirai is a prominent example of a massive IoT-driven DDoS botnet that has strongly influenced and enabled DDoS-for-hire and DDoSaaS operations.TurboMirai- Layer 7 DDoS attacks surged by 104% over the last 2 years (2023–2025). Super botnets like Aisuru and Kimwolf (TurboMirai variants) enable accessible DDoS as a service, making sophisticated attacks available to anyone.
Vendors
Products
Akamai API SecurityThe data in this section on API attack trends comes from the Akamai API Security platform, which detects both web-based and behavior-based API attacks.Akamai App & API ProtectorThe API and web application attack data in this section comes from Akamai App & API Protector, which focuses primarily on web attacks.Akamai DNS Posture ManagementValidation with research from Akamai DNS Posture Management began to surface disproportionate insights.Akamai Prolexic RoutedAkamai Prolexic Routed protects organizations from DDoS attacks by blocking malicious traffic before it reaches applications,
Countries
IsraelEurope has remained a primary focal point of DDoS-related hacktivist claims, while Israel, the United States, and Ukraine were also top targets in H1 2025.RussiaFor example, Qilin, also known as Agenda, is a Russia-linked RaaS group first observed in 2022 that has more recently enhanced its extortion toolkit to reportedly incorporate DDoS attack capabilities.UkraineEurope has remained a primary focal point of DDoS-related hacktivist claims, while Israel, the United States, and Ukraine were also top targets in H1 2025.United StatesIn Q2 2025, when many RansomHub affiliates joined Qilin after RansomHub’s collapse, Qilin surged to become the top ransomware threat targeting the United States.
Industries
Commerce| 2. Commerce | 2. Games |Financial Services| 1. Media | 1. Financial services |Games| 2. Commerce | 2. Games |Manufacturing| 3. Games | 3. Manufacturing |Media| 1. Media | 1. Financial services |Software and SaaS- [Security spotlight: The impact of DDoS on the software and SaaS industry](#security-spotlight-the-impact-of-ddos-on-the-software-and-saas-industry)Telecom ISP and MNO| 5. Telecom ISP and MNO | 5. Commerce |