NETSCOUT: High-Capacity DDoS Attacks Surge 1,286% in 1H 2026

High-capacity DDoS attacks are no longer rare anomalies — they are routine, forcing enterprises and carriers to rethink mitigation at every network edge.

Distributed Denial-of-Service attacks have crossed a new threshold in 2026. NETSCOUT recorded more than 9.1 million DDoS attacks globally between January and June, and events exceeding 1Tbps or 1Gpps surged by 1,286% year over year. For CISOs, CIOs and service providers, the question is no longer whether a terabit-class attack is possible — it is how many of them your infrastructure can absorb while sustaining service availability.

What was announced

NETSCOUT SYSTEMS, INC. (NASDAQ: NTCT) released its 1H 2026 DDoS Threat Intelligence Report, documenting a significant shift in how attacks are launched and sourced. Based on directly observed ATLAS telemetry across 209 countries and territories, the report highlights that DDoS risk is expanding along three axes: traffic volume to inspect, the number of mitigation points required, and the share of attacks that disrupt service without saturating a link.

The 1,286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine. With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient. Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges.

Why this matters

For enterprise security leaders and procurement teams, the report signals that DDoS resilience now depends on more than stopping the single largest attack. Attackers are combining high-volume floods with short, surgical bursts that stress connection tables, application backends and resolvers. Residential proxy abuse means attack traffic increasingly originates from consumer IP addresses that are difficult to block without impacting legitimate users. Carriers face additional pressure from direct-path methods and outbound attacks that affect their own operational health.

Organizations evaluating DDoS protection, cloud scrubbing capacity and hybrid defense models should align their roadmap with these qualitative shifts in attack sophistication.

Technical details

• Global scale: more than 9.1 million DDoS attacks recorded across 209 countries and territories.
• High-capacity surge: attacks exceeding 1Tbps or 1Gpps grew 1,286% year over year.
• IPv6 milestone: first IPv6 attack exceeding 1Tbps observed; active IPv6 mitigation rose more than 300% year over year.
• Direct-path dominance: direct-path methods accounted for 64% of observed attacks, gaining share for a third consecutive half-year.
• Carpet-bombing: share grew from 3.97% to 4.54% of attacks.
• DDoS-for-hire economics: attacks lasting one minute or less have roughly doubled as a share since 2H 2023.
• Residential proxies: ASERT correlated residential proxy networks with DDoS telemetry, confirming consumer IP sources participating in attacks.
• NETSCOUT coverage: protects two-thirds of the routed IPv4 space, securing edges that carried global peak traffic over 800 Tbps.

Softprom and NETSCOUT

Softprom is the official distributor of NETSCOUT. Our team helps enterprises and service providers deploy NETSCOUT Arbor DDoS Protection, ARBOR Cloud and ATLAS-powered threat intelligence to defend against terabit-class attacks, carpet-bombing and residential proxy abuse.

This content was prepared as part of the Softprom DistriFlow project — an automated system for monitoring and adapting vendor news. Original source: original article.