DDoS attacks top 9.1 million in H1 2026, Netscout report finds
According to Help Net Security, Netscout’s DDoS Threat Intelligence Report counted more than 9.1 million DDoS attacks worldwide between January and June 2026, up nearly a quarter year over year. Attacks above 1 Tbps or 1 Gpps grew 1,286%, and the report says many attacks exhaust network equipment before bandwidth runs out. This is a trend report, not a single incident, and no CVE is involved.
What we know
The figures below come from Netscout’s report as summarised by Help Net Security.
- More than 9.1 million attacks were recorded in the first half of 2026, nearly 25% more than a year earlier.
- Attacks exceeding 1 Tbps or 1 Gpps rose 1,286% year over year. Much of the growth is tied to botnet operators associated with Aisuru, Kimwolf, Jackskid and their successors, meaning attackers need fewer devices to launch large attacks.
- Direct-path attacks, which send traffic straight at a target, made up 64.4% of observed attacks, growing for a third consecutive six-month period.
- Carpet-bombing, which spreads traffic across many addresses in a prefix so each stays below detection thresholds, rose from 3.97% to 4.54% of attacks.
- Single-method attacks were 52.27% of the total. Common techniques were TCP floods, DNS attacks and reflection/amplification floods.
- Netscout’s ATLAS system recorded its first IPv6 attack above 1 Tbps, and active mitigation of IPv6 attacks rose by more than 300%, although IPv6’s share of attacks was roughly unchanged.
- Service providers mitigated 23.12% of observed attacks, versus 22.35% a year earlier.
Why DDoS attacks cause outages before links are full
Many of these attacks flood devices with packets, requests and connections. Firewalls and load balancers can run out of processing resources even though the network’s bandwidth is not exhausted. The report describes attacks of billions of packets per second overwhelming individual router line cards where protections were missing. When a card stops forwarding, customers and networks that were not the target can be disconnected too.
Who is affected
The report frames the risk for both service providers and enterprises. Providers face collateral damage on shared infrastructure, while enterprises that rely on perimeter firewalls or load balancers can be knocked offline by packet-rate attacks. The source does not name specific victims, sectors or regions, so those details are not disclosed here.
Why this matters
Analysis, not reported fact: bandwidth headroom alone is a poor measure of DDoS resilience. Packet rate, connection-table capacity and per-address detection thresholds are the limits most likely to fail first in a typical environment. Carpet-bombing in particular can slip past alerting tuned for a single destination address.
What has not been confirmed
The statistics are Netscout’s own measurements, and we have not independently verified them. The source article does not give a breakdown by industry or country, nor the exact peak size of the largest attack.
What to do
- Check where your DDoS protection sits. Netscout’s guidance, as relayed by Help Net Security, is that enterprises need protection close to their services, backed by dedicated DDoS services from providers.
- Ask your upstream provider about scrubbing capacity at the network edge and whether they offer selective, fine-grained mitigation rather than broad blocking.
- Review detection thresholds so they cover traffic aggregated across a whole prefix, not just per address, to catch carpet-bombing.
- Measure packets per second and connection-state limits on firewalls and load balancers, and test them, not only link bandwidth.
- Include IPv6 in your DDoS monitoring and mitigation plans.
- Hunt for signs of the common techniques named in the report: TCP floods, DNS attacks and reflection/amplification traffic in flow data.
- Rehearse a runbook for contacting your provider during an attack, since collateral outages can affect networks that were not targeted.
