Top Highlights
- Over 9.1 million DDoS attacks worldwide in the first half of 2026, with a 1,286% increase in attacks exceeding 1Tbps or 1Gpps, indicating rising attack intensity.
- IPv6 attacks surpassed 1Tbps for the first time, with mitigation efforts increasing by over 300%, highlighting the growing importance of robust IPv6 defense.
- Short, rate-based attacks from DDoS-for-hire platforms and residential proxies are increasing, enabling attackers to overwhelm networks using harder-to-detect consumer IPs.
Overview of Threat, Attack Techniques, and Targets
NETSCOUT’s recent report shows a sharp increase in DDoS attacks worldwide. In the first half of 2026, over 9.1 million attacks were recorded across 209 countries. The size of these attacks is also increasing. Attacks that exceed 1 terabit per second (Tbps) or 1 billion packets per second (Gpps) grew by 1,286% compared to last year. Notably, the first IPv6 attack over 1Tbps was seen, and IPv6 attacks in general increased by over 300%. This indicates that attackers are using bigger volumes of traffic and newer IP protocols to target organizations.
The report highlights that attackers use many different methods. About 64% of attacks rely on direct-path techniques, which involve sending large volumes of malicious traffic straight to the target. Carpet-bombing, where attackers send many short, rapid attacks, now makes up over 4.5% of attacks. Attackers also use residential proxies, which are IP addresses from consumer devices, making it harder to identify malicious traffic. Targets include network providers, enterprises, and services that have online presence.
Impact, Security Implications, and Remediation Guidance
The large scale and increasing frequency of these attacks threaten organizations’ online services. High-capacity attacks, especially those over 1Tbps, can cause immediate service outages and disrupt normal operations. This pressure emphasizes the need for better security measures. Attackers are also shortening attack durations, which puts additional stress on defenses. The use of residential proxies complicates detection and mitigation efforts.
To combat these threats, organizations should seek solutions that provide layered security. This includes applying precise filtering at network edges and deploying cloud-based mitigation services. Resilience actions include monitoring for both inbound and outbound malicious traffic and increasing scrubbing capacity to handle large assaults. For specific remediation strategies, organizations should consult their security vendors or relevant authorities, as detailed guidance should be tailored to their infrastructure and needs.
Continue Your Tech Journey
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
