Netscout ties much of a 1,286% rise in DDoS attacks above 1 Tbps or 1 Gpps to Aisuru-linked botnets
Netscout reports that DDoS attacks exceeding 1 Tbps or 1 Gpps rose 1,286% year over year in the first half of 2026. It says many of these floods exhaust firewalls and load balancers before the link fills.
The Watch · Security desk
Attacks exceeding 1 Tbps or 1 Gpps rose 1,286% year over year, about 13.9 times the year-earlier level. Netscout recorded more than 9.1 million DDoS attacks worldwide from January to June 2026, up nearly a quarter year over year.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Rise in attacks above 1 Tbps or 1 Gpps, year over year | 1,286% | 2 | |
| Multiple of year-earlier level, about | 13.9 times | attacks above 1 Tbps or 1 Gpps | 14 |
| DDoS attacks worldwide, Jan-June 2026, over | 9.1 million attacks | up nearly a quarter year over year | 1 |
What happened
- Netscout counted more than 9.1 million DDoS attacks worldwide from January to June 2026, nearly a quarter more than a year earlier.
- Carpet-bombing made up a larger share of the attacks Netscout observed: 4.54% in the first half of 2026, up from 3.97% in the same period of 2025.
- Every DDoS-for-hire service Netscout reviewed had its launch form preset to a single 60-second attack with a free method selected.
- Attacks of billions of packets per second have overwhelmed router line cards that lacked protection, and a stalled card can cut off customers and networks that were not targeted.
Why it matters
- What it limits constraint Carpet-bombing keeps traffic to each address under detection thresholds, while blocking broadly across the prefix disrupts customers. Filtering has to be selective to work.
- Who has to decide decision Provider controls often protect shared infrastructure first and leave customer protection to dedicated DDoS services. Each enterprise has to decide where its own filtering sits.
- What doesn't add up contradiction Modi stresses short attacks, yet those lasting a minute or less nearly doubled only from 1.6% of incidents to 3.1%. The other 96.9% run longer, so a defense sized for bursts misses most attacks.
Netscout's case for finer controls comes from Hardik Modi, VP Engineering for DDoS Solutions. "With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient. Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts in attack sophistication," Modi said [4].
The 1,286% figure works out to about 13.9 times the year-earlier level [14]. Netscout says much of the growth came from botnet operators associated with Aisuru, Kimwolf, Jackskid and their successors [3], and that attackers therefore need fewer devices to launch large attacks [18]. The figure covers two thresholds, 1 Tbps and 1 Gpps, and Help Net Security's account of the report does not split them, give the counts behind them, or say how many attacks exhausted equipment before a link filled [2]. In our view the line-card cases are the specific failures the report describes. The firewall and load balancer point is Netscout's statement of the mechanism [5][6].
The share of attacks that service providers mitigated moved by less than a point: 23.12% against 22.35% a year earlier, a gain of 0.77 points [8][15]. Netscout says the growth in total attacks raised both the number mitigated and the number that reached their targets [9].
Sellers promote methods they claim can bypass specific defenses, and they stress packet, connection and request rates over bandwidth [19]. Help Net Security's account says those claims have not been independently verified [19]. Advertised plans run from free access to around $20,000 a month, and matching tiers and near-identical backend technology indicate that competing storefronts may share infrastructure [20].
What to watch
- A breakdown of the 1,286% rise by bandwidth threshold and packet-rate threshold, with the attack counts behind each.
- Independent testing of the DDoS-for-hire sellers' claims that their methods bypass specific defenses.
- Any disruption of the shared backend infrastructure that Netscout says may sit behind competing DDoS-for-hire storefronts.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
More than 9.1 million DDoS attacks were recorded globally between January and June 2026, an increase of nearly a quarter year over year, according to Netscout's DDoS Threat Intelligence Report.
- [2]
Attacks exceeding 1 Tbps or 1 Gpps increased 1,286% year over year.
- [3]
Much of the growth in attacks above 1 Tbps or 1 Gpps came from botnet operators associated with Aisuru, Kimwolf, Jackskid, and their successors.
- [4]
"With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient. Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts in attack sophistication," said Hardik Modi, VP Engineering, DDoS Solutions, and ASERT Threat Intelligence Team, NETSCOUT.
- [5]
Many of these attacks overwhelm network equipment with huge numbers of packets, requests and connections. Firewalls and load balancers can run out of resources to process them even before the network's bandwidth is exhausted.
- [6]
Attacks delivering billions of packets per second have overwhelmed individual router components known as line cards where protective measures were missing. When a card stops forwarding traffic, it can disconnect customers and networks that were not targeted.
- [7]
Carpet-bombing attacks rose from 3.97% of observed attacks in the first half of 2025 to 4.54% in the first half of 2026. These attacks spread traffic across many destination addresses within a network prefix, and traffic to each address can remain below detection thresholds as the combined volume overwhelms the network or shared infrastructure.
- [8]
Service providers applied mitigation to 23.12% of observed attacks, compared with 22.35% a year earlier.
- [9]
Growth in total attacks increased both the number of attacks mitigated and the number reaching their targets.
- [10]
Provider controls often prioritize shared infrastructure, with customer protection supplied through dedicated DDoS services.
- [11]
Every DDoS-for-hire service reviewed had its launch form set to a single attack lasting 60 seconds, with a free method selected.
- [12]
Across all observed incidents, attacks lasting one minute or less rose from 1.6% in the second half of 2023 to 3.1% in the first half of 2026. Longer attacks continued to account for the majority.
- [13]
Broad blocking measures can disrupt customers when attacks span many addresses.
- [14]
A 1,286% year-over-year rise is about 13.9 times the year-earlier level of attacks above 1 Tbps or 1 Gpps.
- [15]
The share of observed attacks mitigated by service providers rose 0.77 percentage points year over year.
- [16]
About 96.9% of observed attacks lasted longer than one minute in the first half of 2026.
- [17]
The share of attacks lasting one minute or less nearly doubled between the second half of 2023 and the first half of 2026.
- [18]
Netscout's report says that means attackers need fewer devices to launch large attacks.
- [19]
Sellers promote methods they claim can bypass specific defenses, emphasizing packet, connection and request rates over bandwidth alone. The bypass claims have not been independently verified.
- [20]
Advertised DDoS-for-hire plans range from free access to around $20,000 a month. Matching subscription tiers and near-identical backend technology indicate that competing storefronts may share infrastructure.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- helpnetsecurity.comDDoS attacks can knock services offline before links reach capacity
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.