What Is a DDoS Attack in 2026

Web DDoS attacks rose 110.6% in H1 2026 compared to H1 2025, while Cloudflare mitigated 805 network-layer attacks exceeding 1 Tbps in Q2 alone. Increased application-layer activity, multi-terabit floods, and botnets on consumer devices have invalidated reactive mitigation assumptions. Teams require upstream capacity to handle peak traffic, automated filtering that responds within seconds, and outbound controls to stop compromised devices from attacking other networks.

Key Takeaways:

Radware recorded a 110.6% year-over-year increase in web DDoS attacks during H1 2026.

Cloudflare mitigated 805 attacks exceeding 1 Tbps in Q2 2026, compared with 130 in Q1.

Four disrupted botnets collectively infected more than 3 million IoT devices. Aisuru alone had harnessed more than 500,000 devices.

Short, automated floods leave little time for manual intervention, making always-on filtering and preapproved response policies necessary.

Outbound mitigation can prevent compromised subscriber devices from consuming provider capacity or attacking external targets.

The Explosive Growth of DDoS Attacks in 2026

Radware recorded a 110.6% increase in web DDoS attacks during H1 2026 compared to H1 2025, and 36.3% higher than H2 2025. Web DDoS mitigations reached nearly 83% of Radware’s total 2025 volume in six months. These figures come from Radware’s cloud and managed security services, reflecting its customer base rather than the entire internet.

Outbound Mitigation and Network-Level Defense

Network-layer activity increased alongside application-layer floods. Customers averaged 110 network attacks per day, 36.6% above Radware’s 2025 baseline. Direct-path UDP floods generated 73% of mitigated packets; adding fragmented UDP raised that above 80%, indicating attackers sent large volumes directly rather than relying mainly on third-party reflectors.

Cloudflare observed the same rise at the upper end: 805 network-layer attacks above 1 Tbps in Q2 2026 compared to 130 in Q1, a 519% quarter-over-quarter increase, with nearly 1,000 terabit-scale attacks across H1. It also handled 23.2 million network-layer attacks and 29.64 trillion malicious HTTP requests during H1, according to its H1 2026 figures reported by BleepingComputer.

Record-Scale Campaigns and High-Bandwidth Floods

Link11’s European Cyber Report recorded fewer attacks on its network during H1 2026, but each intensity measure reached a new high. Peak attack reached 2.3 Tbps compared to 1.2 Tbps in H1 2025. Peak packet rate rose from 207 million to 322 million packets per second, while cumulative six-month traffic increased from 438 to 705 terabytes.

Link11 measurement	H1 2025	H1 2026	Reported change	Source
Peak attack bandwidth	1.2 Tbps	2.3 Tbps	85% increase	Link11 report coverage
Peak packet rate	207 million packets per second	322 million packets per second	56% increase	Link11 report coverage
Cumulative six-month traffic	438 terabytes	705 terabytes	61% increase	Link11 report coverage

Arelion observed larger campaigns on its backbone: its 2026 report cites attacks reaching 6.1 Tbps and a 31.4 Tbps Aisuru peak from December 2025, which also reached 200 million requests per second. The 31.4 Tbps was a late-2025 event cited in a 2026 report; Arelion’s 6.1 Tbps figure describes the report’s current attack measurements.

Bandwidth is only one capacity limit. A flood of small packets can overwhelm packet-processing capacity before saturating a link, while stateful application requests consume connection tables, worker pools, and backend resources. A defense plan needs separate thresholds for bits per second, packets per second, requests per second, concurrent sessions, error rates, and origin latency.

Aisuru, KimWolf, and the Consumer Device Attack Surface

Aisuru generated about 33% of DDoS attack traffic observed on Arelion’s network, according to the carrier’s 2026 DDoS report. The botnet controlled more than 500,000 IoT devices and Android-based systems. Its KimWolf variant infected over 2 million Android television and streaming devices by early 2026.

Those figures should not be combined into a claim that Aisuru alone infected more than 3 million devices. The larger count applies collectively to Aisuru, KimWolf, JackSkid, and Mossad. Authorities in the United States, Germany, and Canada disrupted infrastructure supporting those four botnets in March 2026 after they had collectively compromised more than 3 million devices, including cameras, digital video recorders, and Wi-Fi routers.

Consumer devices give attackers two advantages: traffic originates from real residential addresses rather than obviously spoofed sources, and large fleets can establish stateful sessions against legitimate ports, making broad address or port blocking harmful to real users. Nokia estimated residential proxy botnets include roughly 200 million compromised devices worldwide, with potential aggregate capacity between 250 and 600 Tbps, in its Deepfield Genome Shield announcement.

Home networking hardware and connected consumer devices — Routers, cameras, televisions, and streaming devices can become distributed traffic sources inside residential networks.

AI changes coordination rather than bandwidth. Netscout described its use across reconnaissance, exploitation, target selection, vector switching, and protecting infected devices from competing botnets. Automation lets an operator change attack behavior faster and coordinate more endpoints, but traffic still comes from compromised hardware and available network connections. Defenders should separate the automation layer from the actual devices and bandwidth producing the flood.

Outbound Mitigation and Network-Level Defense

Netscout expanded Arbor Cloud capacity from 15 Tbps to 33 Tbps across 16 global scrubbing centers, following its May 2026 acquisition of DigiCert’s DDoS and WAF services. According to Network World’s report on the buildout, supporting that capacity required carrier bandwidth, clean return capacity, 100-gigabit ports, routing hardware, switching hardware, and pass-or-drop decision software.

Scrubbing capacity has a trade-off: it can absorb floods exceeding an organization’s transit links, but traffic diversion adds operational dependencies and can be too slow for attacks lasting seconds. Cloudflare found 90.6% of network-layer attacks ended within 10 minutes. Arelion measured an average duration of 8.9 minutes, 20% shorter than the previous measurement period. Waiting for an analyst to confirm an alert and contact a provider wastes most of the response window.

Nokia’s Deepfield Genome Shield takes a proactive approach, compiling threat intelligence into automated policies enforced using network infrastructure. Deepfield Secure Genome covers more than 5 billion internet endpoints, according to the vendor’s launch announcement. Red Dot Technologies was among the first operators to deploy the system for inbound protection and threats originating from compromised subscriber devices. Because these are vendor claims, operators should verify false-positive rates, policy update latency, routing compatibility, and failure behavior in their own networks.

Outbound filtering changes the provider’s role: instead of protecting only its own service or customer destination, the provider identifies malicious traffic leaving compromised subscriber networks. This can lower congestion, infrastructure cost, abuse complaints, and harm to third parties. It also introduces operational risk (an inaccurate policy can block legitimate subscriber traffic) so enforcement needs audit logs, rollback controls, staged deployment, and clear escalation paths.

The Shrinking Response Window

Short floods can cause damage after traffic returns to normal: connection queues remain saturated, autoscaling systems continue launching capacity, caches require repopulation, and dependent services retry failed requests. A ten-minute burst can create a longer availability incident even when the origin survives the initial load.

Attack traffic can also hide a different operation. Link11 documented a campaign where attackers flooded two domains while conducting SQL injection and cross-site scripting probes; investigators connected the activity because the same IP addresses participated in both. Detection teams should correlate edge traffic with WAF events, application errors, authentication failures, database load, and response-code changes instead of treating a bandwidth spike as an isolated network incident.

Radware found the average interval between a CVE announcement and the first detected attack fell below zero in H1 2026, compared to 21.5 days after disclosure in 2025 and 53 days in 2024. It also reported more than four out of five observed vulnerabilities were attacked before their official CVE announcement. DDoS and vulnerability exploitation are separate activities, but an attacker can combine them by using a flood to distract responders or degrade security telemetry while probing an application.

Security analysts monitoring network activity and operational dashboards — Network, edge, and application telemetry must remain available during the flood, when responders need it most.

Botnet Takedowns and Persistent Reinfection Risk

The March 2026 international operation disrupted command-and-control infrastructure used by Aisuru, KimWolf, JackSkid, and Mossad. Court documents cited by the U.S. Justice Department reported more than 200,000 attack commands from Aisuru, more than 25,000 from KimWolf, more than 90,000 from JackSkid, and more than 1,000 from Mossad. The operation targeted servers, domains, and other infrastructure used to control infected devices.

A takedown can interrupt commands and reduce immediate capacity, but it does not automatically fix vulnerable routers, cameras, or streaming boxes. Devices that remain exposed can be reclaimed by the same operator, recruited by a competing botnet, or used through a replacement control channel. Network operators therefore need ongoing outbound monitoring after a law-enforcement action instead of treating the event as permanent remediation.

Operation PowerOFF provides another example: Cloudflare observed DDoS activity decline after an international action seized 53 domains, executed 25 search warrants, arrested four suspects, and sent warnings to more than 75,000 users of DDoS-for-hire services. Enforcement can reduce activity, but the underlying supply of exposed devices and purchasable attack infrastructure remains.

Effects on Technology, Finance, Gaming, and Cloud Services

Radware recorded the technology sector as the target of 59.4% of network DDoS attacks in its H1 data, averaging 509 attacks per customer per day. Financial services received 20.8%. Arelion identified gaming and cloud providers as primary Aisuru targets, with attacks frequently exceeding 1 Tbps across its backbone. These organizations face concentrated risk because a single platform can expose authentication, APIs, real-time sessions, and shared infrastructure through the same public edge.

Cloudflare’s sector data differs because it measures HTTP requests rather than Radware’s network attack distribution. Media, production, and publishing received 14.2% of mitigated HTTP DDoS requests in H1 2026. The difference shows why organizations should avoid using one vendor’s sector ranking as a universal model: providers observe different customers, protocols, and parts of the internet.

Risk also varies by architecture. A cloud service can have substantial aggregate capacity yet still fail at a regional ingress point, stateful gateway, or origin dependency. A gaming service can withstand bandwidth while losing session state or matchmaking availability. Financial services must preserve user access without weakening fraud controls during an attack. Testing should use business transactions and service-level indicators, not only network throughput.

DDoS Readiness Checklist for 2026

Measure every exhaustion point: Track bandwidth, packet rate, request rate, concurrent sessions, connection-table use, origin latency, error rates, and queue depth.
Set automatic activation policies: Preapprove diversion and filtering thresholds so mitigation does not wait for manual confirmation.
Validate upstream capacity: Confirm that transit links and the mitigation provider can handle the contracted traffic before it reaches the application edge.
Protect authoritative DNS: Cloudflare reported DNS floods rising from 25.7% of network-layer attacks in Q1 to 40% in Q2 2026.
Monitor outbound traffic: Detect compromised subscriber and enterprise devices before they generate abuse or consume provider capacity.
Correlate network and application events: Search for injection probes, authentication anomalies, and application errors during volumetric incidents.
Preserve telemetry under load: Route security logs and operational metrics through paths that do not depend on the affected service.
Test rollback and false-positive handling: Automated blocking must include staged rollout, audit records, emergency exceptions, and rapid reversal.
Exercise the provider handoff: Verify contacts, routing changes, clean-traffic return paths, and escalation procedures before an incident.
Continue monitoring after takedowns: Disabled command infrastructure does not remove vulnerable devices or prevent new botnets from recruiting them.

The 2026 shift is clear: more web-layer attacks, hundreds of terabit-scale events in a quarter, higher packet rates, and shorter campaigns. Capacity remains necessary, but capacity alone cannot separate legitimate residential sessions from automated floods. Effective defense combines always-on upstream filtering, application-aware controls, outbound mitigation, and telemetry that remains usable while the service is under pressure.

More in-depth coverage from this blog on closely related topics:

Sources and References

Sources cited while researching and writing this article: