More than 9.1 million distributed denial-of-service (DDoS) attacks were recorded globally in the first half of 2026, as a sharp rise in high-capacity incidents and increasingly short attacks put pressure on telecommunications networks and enterprise defences.
The number of attacks exceeding 1 terabit per second (Tbps) or 1 billion packets per second (Gpps) increased by 1,286% year on year, according to network security company NETSCOUT’s latest ‘Threat Intelligence Report,’ published on 14th October.
The company recorded attacks across 209 countries and territories between January and June, a 14% increase on the second half of 2025.
Telecommunications infrastructure was a major target. NETSCOUT recorded more than 2.08 million attacks against wired communications and 2.84 million against wireless communications, bringing the combined total to nearly 5 million.
The findings highlight the exposure of the networks underpinning connected devices, industrial systems and other critical services to attacks designed to disrupt availability rather than steal data.
“The 1,286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine,” said Hardik Modi, Vice-President of Engineering for DDoS solutions and the ASERT Threat Intelligence Team at NETSCOUT. “With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient.”
Modi said providers and enterprises needed more selective traffic filtering and greater mitigation capacity at network Edges to respond to changes in attack methods.
The report points to a shift towards attacks that can disrupt services without overwhelming network links. Attacks lasting one minute or less have roughly doubled as a share of activity since the second half of 2023, while attacks lasting between one and two minutes have increased by 37%.
These shorter incidents can place pressure on connection tables, application backends and domain name system resolvers, potentially disrupting services even when traffic volumes remain below the thresholds associated with the largest attacks.
NETSCOUT also identified residential proxy networks being used as sources of DDoS traffic. Such networks route traffic through consumer internet connections, making malicious activity harder to distinguish from legitimate users.
The report suggests that the commercial model for DDoS-for-hire services is also evolving, with subscription packages, free tiers and published attack methods lowering the barriers to launching attacks.
For organisations operating connected infrastructure, the combination of harder-to-identify traffic sources and shorter, more targeted incidents complicates the task of maintaining service availability.
NETSCOUT recorded its first IPv6 attack exceeding 1Tbps during the reporting period. Active mitigation of IPv6 attacks rose by more than 300% year on year, although IPv6’s share of total attacks remained broadly unchanged.
The company also found that direct-path methods accounted for 64% of observed attacks, increasing their share for a third consecutive six-month reporting period. Carpet-bombing attacks, which distribute traffic across multiple addresses or parts of a network, rose from 3.97% to 4.54% of attacks.
NETSCOUT said the findings reinforced the need for protection that can filter malicious traffic at exposed network points, alongside Cloud-based mitigation for attacks that exceed local capacity.
The report is based on attack traffic directly observed by NETSCOUT through its global network visibility and mitigation infrastructure. The company said it does not combine separate incidents or geographically distributed events to produce composite peak attack figures.
The findings add to the operational challenges facing telecommunications providers and organisations that depend on connected systems. As attacks become more varied in scale, source and duration, resilience will depend not only on absorbing high-volume traffic but also on identifying and filtering activity that can disrupt individual services.
There’s plenty of other editorial on our sister site, Electronic Specifier! Or you can always join in the conversation by visiting our LinkedIn page.
