NETSCOUT Reports 1,286% Surge in High-Capacity DDoS Attacks in First Half of 2026

NETSCOUT Systems has released its first-half 2026 Distributed Denial-of-Service (DDoS) Threat Intelligence Report, revealing a significant shift in how attacks are launched and sourced. NETSCOUT recorded more than 9.1 million DDoS attacks globally between January and June 2026, highlighting growing risks for enterprises and service providers.

According to the report, DDoS risk is increasing across three areas: the volume of traffic that must be inspected, the number of locations where mitigation must be deployed, and the proportion of attacks that disrupt services without saturating network links.

“The 1,286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine,” said Hardik Modi, VP Engineering, DDoS Solutions, and ASERT Threat Intelligence Team at NETSCOUT.

“With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient. Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts in attack sophistication.”

Key Findings From NETSCOUT’s DDoS Threat Intelligence Report

The report highlights several developments in the global DDoS threat landscape.

- More Than 9.1 Million Global Attacks: NETSCOUT ATLAS recorded more than 9.1 million DDoS attacks across 209 countries and territories, highlighting the expanding operational risks facing enterprises and service providers.

- Sharp Increase in High-Capacity Attacks: Attacks exceeding 1 terabit per second (Tbps) or 1 billion packets per second (Gpps) increased by 1,286% year over year, indicating that organizations must prepare for greater attack intensity.

- IPv6 Attacks Cross the Terabit Threshold: NETSCOUT observed its first IPv6 attack exceeding 1 Tbps. Active mitigation of IPv6 attacks also increased by more than 300% year over year, even as IPv6's share of total attacks remained roughly flat. The findings highlight the need for robust IPv6 protection.

- Increasing Pressure on Carrier Mitigation: Direct-path methods accounted for 64% of observed attacks and gained share for the third consecutive half-year. Carpet-bombing attacks increased from 3.97% to 4.54% of attacks, while outbound attacks exceeding 1 Tbps or 1 Gpps caused operational impacts. Dedicated mitigation capacity remains important for selectively filtering malicious traffic.

- Shorter Attacks and DDoS-for-Hire Services: Attacks lasting one minute or less have roughly doubled as a share since the second half of 2023. These short-duration attacks put pressure on connection tables, application backends and resolvers, highlighting how DDoS-for-hire platforms can make launching attacks easier.

- Residential Proxy Networks: By combining residential proxy network tracking with DDoS telemetry, NETSCOUT ASERT identified residential proxy sources participating in DDoS attacks. This highlights the challenge of distinguishing malicious traffic originating from consumer IP addresses.

NETSCOUT Tracks Global DDoS Attack Activity

NETSCOUT monitors the DDoS landscape through passive, active and reactive vantage points, providing visibility into global attack trends. For more than 15 years, the company has delivered DDoS intelligence based exclusively on directly observed and verifiable attack traffic.

According to NETSCOUT, its reporting methodology does not combine multiple alerts or geographically distributed events into composite peak values. This approach is intended to support accuracy, repeatability and comparability across reporting periods.

Peak metrics reflect single-second maximum bits-per-second (bps) and packets-per-second (pps) rates measured at defined mitigation and monitoring points.

Layered Protection Against Evolving DDoS Threats

NETSCOUT protects two-thirds of the routed IPv4 space, securing network edges that carried global peak traffic exceeding 800 Tbps. The company monitors tens of thousands of daily DDoS attacks by tracking multiple botnets and DDoS-for-hire services that leverage millions of abused or compromised devices.

NETSCOUT ARBOR Cloud, supported by ATLAS visibility and dedicated DDoS mitigation capacity, complements on-premises defenses and helps organizations absorb large, distributed attacks before they overwhelm critical services.

The report highlights the need for organizations to look beyond the size of individual attacks when developing DDoS resilience strategies. Businesses must recognize changing attack sources and methods, mitigate inbound and outbound attacks, apply precise protection where services are exposed, and use cloud capacity when attacks exceed local defenses.

NETSCOUT combines directly observed ATLAS intelligence with on-premises and cloud-delivered mitigation to help customers protect service availability and sustain critical digital operations.