NETSCOUT: The New DDoS Economy in 1H 2026

The first half of 2026 did not introduce a new DDoS technique. It revealed something more consequential: the industrialization of existing attacks, where delivery quality, source authenticity and operational efficiency now outweigh raw bandwidth.

Attackers are no longer competing on volume alone. DDoS-for-hire platforms market methods engineered to bypass specific defenses, residential proxy networks supply source addresses that resemble legitimate users, and attacks exceeding 1Tbps or 1Gpps have become dramatically more common. For CIOs, CISOs and service providers, this signals a new operational baseline that demands more intelligent, selective mitigation.

What was announced

NETSCOUT published its 1H 2026 DDoS Threat Intelligence Report, drawing on ATLAS visibility across roughly two-thirds of routed IPv4 space and more than 800Tbps of peak traffic traversing protected network edges. The report documents 9,146,021 DDoS attacks observed globally in the first half of 2026 across 209 countries and territories, 12,031 ASNs and 413 industry verticals.

Daily attack counts increased by nearly a quarter compared with 1H 2025, and the growth accelerated across successive reporting periods. Nearly half of all DDoS attacks now combine multiple vectors, blending volumetric, protocol and application-layer techniques in a single campaign.

Headline findings include:

• High-impact attacks surged 1,286 percent year over year: from 79 in 1H 2025 to 167 in 2H 2025 and 1,095 in 1H 2026.
• First IPv6 DDoS attack exceeding 1Tbps recorded by ATLAS, with active IPv6 mitigation up more than 300 percent year over year.
• Direct-path attacks represented 64.4 percent of all observed attacks, with reflection and amplification at 35.6 percent.
• Carpet-bombing attacks rose 14 percent compared with 1H 2025.
• Arbor Cloud SOC mitigated a 3.5Tbps UDP flood against a hosting provider with no customer-visible impact.

Why this matters

For CIOs, CISOs, IT directors and procurement leaders, the shift is strategic. Reflection attacks can often be contained with a relatively small rule set, but direct-path and multivector attacks require selective inspection and mitigation to separate malicious traffic from legitimate demand. Rate-based attacks increasingly target stateful infrastructure, exhausting connection tables in firewalls, load balancers and NAT devices before network links approach saturation.

The DDoS-for-hire market now resembles commercial software, with professional storefronts, tiered subscriptions, APIs and cryptocurrency payments. Source address quality has become a key differentiator, and residential proxy networks route attack traffic through consumer devices that evade traditional reputation-based defenses. Procurement teams evaluating protection must look beyond peak mitigation capacity to behavioral analytics and intelligent traffic engineering.

Familiar DDoS methods have become larger, easier to acquire and more difficult to distinguish from legitimate activity. Defenders must focus on preserving service under attack, not simply containing malicious traffic.

Technical details

• Attack volume: 9,146,021 DDoS attacks across 209 countries, 12,031 ASNs, 413 verticals.
• High-impact growth: 1,286 percent year-over-year rise in attacks exceeding 1Tbps or 1Gpps.
• Attack structure: 64.4 percent direct-path, 35.6 percent reflection and amplification; nearly 50 percent multivector.
• IPv6 milestone: first ATLAS-observed IPv6 DDoS above 1Tbps; active mitigation up 300 percent year over year.
• Carpet-bombing: 14 percent growth, distributing traffic across prefixes to evade per-host detection.
• Supply chain: DDoS-for-hire storefronts rely on a small number of shared platforms; residential proxies supply high-quality source IPs.
• Visibility: NETSCOUT ATLAS covers roughly two-thirds of routed IPv4 space and over 800Tbps of peak traffic.

Softprom and NETSCOUT

Softprom is the official distributor of NETSCOUT. Our team helps service providers and enterprises deploy Arbor Networks DDoS protection, combining on-premises mitigation with cloud-delivered defense to counter direct-path, multivector and carpet-bombing attacks.

This content was prepared as part of the Softprom DistriFlow project — an automated system for monitoring and adapting vendor news. Original source: original article.