Executive Summary Since our seven-part analysis of the DDoS-for-hire landscape in December 2024, the integration of artificial intelligence (AI) into the booter/stresser ecosystem has accelerated significantly. What was then an emerging trend has now become an operational reality across multiple stages of the attack...
Executive Summary The internet is a system of systems. There is no central organizing committee that governs how it is constructed and operated. There are norms and best practices, as well as agreed-upon standards of operation such as what an Internet Protocol (IP) datagram looks like and how it should be interpreted...
Executive Summary When does sharing threat intelligence actually stop attacks? The MegaMedusa case provides a rare, measurable answer. In March 2025, when open threat intelligence identifying proxy infrastructure went public, something remarkable happened: RipperSec’s impactful distributed denial-of-service (DDoS)...
Executive Summary There are just a few internet system services that practically every internet host uses on a regular basis. The Network Time Protocol (NTP), perhaps little known to the average user, is just one such system. However, some NTP systems have been abused to facilitate reflection and amplification (RA)...
Executive Summary As a major player in the field of distributed denial-of-service (DDoS) detection and mitigation, it is crucial for us to closely monitor evolving threats in the DDoS landscape. Over the last year, NETSCOUT analysts observed a handful of newly emerged botnets, incapable of packet spoofing but potent...
Executive Summary In October 2025, multiple high-impact direct distributed denial-of-service (DDoS) demonstration attacks exceeding 20Tb/sec and/or 4gpps were publicly reported. These attacks, primarily targeting online internet gaming organizations, were launched using a Mirai-derivative Internet of Things (IoT) DDoS...
Executive Summary IPv4 addresses have run out! It would have been fashionable to make this claim in 2011 when the last of the IPv4 addresses in the “free pool” were allocated. It took several years, but today most of those remaining addresses are accounted for. How has the distribution and use of these last addresses...
Executive Summary Between February and September 2025, NETSCOUT’s ATLAS telemetry confirmed 249 distributed denial-of-service (DDoS) attacks attributed to the threat actor Keymous+ targeting organizations across 15 countries and 21 industry sectors. Although the group’s individual attacks peaked at 11.8Gbps...
Executive Summary July’s botnet-driven distributed denial-of-service (DDoS) activity remained elevated, with pressure spikes around the U.S. holiday period and continued automation from commodity botnets. NETSCOUT observed more than 20,000 total DDoS attack events (more than 600/day), with a sharp July 3 surge to more...
The integration of artificial intelligence (AI) assistants into distributed denial-of-service (DDoS)-for-hire platforms represents the next logical, and alarming, evolution in a cybercrime ecosystem that already has undergone dramatic transformation. The integration of QueryAI-1.0 into .net exemplifies an...
Executive Summary Analyzing transmission control protocol (TCP) SYN segments, the initial step in the TCP three-way handshake, can reveal patterns and anomalies in network traffic, providing insights into potential threats. In this article, we use data collected from NETSCOUT honeypots, which are systems designed to...
Executive Summary On April 28, 2025, a large-scale power outage disrupted Spain, Portugal, and parts of France, disconnecting millions from the grid and interrupting critical infrastructure and the national internet at large. Triggered by a rapid imbalance in electricity generation, the blackout began at 10:33 UTC (12...
Executive Summary In the last two months, DieNet, a new hacktivist group, has claimed more than 60 distributed denial-of-service (DDoS) attacks, targeting critical infrastructure from U.S. transit systems to Iraqi government websites. This group announced itself on March 7, 2025, via a now-banned Telegram channel...
Executive Summary Attackers didn’t need new exploits to drive more than 27,000 botnet-driven distributed denial-of-service (DDoS) attacks in March 2025. Instead, they weaponized years-old vulnerabilities to launch smarter, longer-lasting campaigns hitting service providers with an average of one attack every two...
Executive Summary Between January 20 and 24, the town of Davos-Klosters, Switzerland hosted the annual World Economic Forum (WEF). Among the key highlights drawing media attention were several special addresses by prominent political figures. NETSCOUT’s ASERT team observed an increased volume of DDoS attacks shortly...
The world of DDoS-for-hire services has rapidly evolved, bringing with it increasingly complex challenges for organizations worldwide. These services, once limited to simple attack execution, have expanded to include automation, API integration, artificial intelligence, and infrastructure abuse.
Artificial intelligence (AI) is making its way into the DDoS-for-hire landscape, adding a new level of sophistication to these already powerful services. While still in its early stages, AI integration in DDoS attacks has begun to enhance the effectiveness and adaptability of these assaults.
Modern DDoS-for-hire platforms have evolved to include sophisticated infrastructure abuse capabilities, enabling attackers to disrupt entire networks and bypass traditional defenses. By targeting multiple assets within a network, leveraging geo-spoofing techniques, and incorporating IPv6 into their strategies, attackers have increased the complexity of defending against these threats.
Automation has become a cornerstone of modern DDoS-for-hire services, enhancing the scale and sophistication of attacks while reducing the need for continuous human oversight. This development has made it easier for attackers to deploy persistent, complex campaigns with minimal effort.
Login
