There has been a significant shift in how attacks are launched and sourced, according to the https://www.netscout.com/threatreport/ from NetScout Systems.
With more than 9,1-million DDoS attacks recorded globally by NetScout between January and June 2026, the report highlights that DDoS risk is growing along three axes: the volume of traffic that must be inspected, the number of places where mitigation must be deployed, and the share of attacks that disrupt service without ever saturating a link.
“The 1 286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine,” says Hardik Modi, vice-president: engineering, DDoS solutions and ASERT threat intelligence team at NetScout. “With the proliferation of residential proxies and short, rate-based attacks from DDoS-for-hire platforms, traditional coarse network controls are insufficient.
“Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts in attack sophistication.”
Key findings from the report include:
- Massive Attacks on a Global Scale – NetScout ATLAS recorded more than 9,1-million DDoS attacks across 209 countries and territories, underscoring the expanding operational risk to enterprises and providers.
- IPv6 crossed the terabit threshold – NetScout observed its first IPv6 attack exceeding 1Tbps, while active mitigation of IPv6 attacks rose by more than 300% year over year even as IPv6’s share of attacks remained roughly flat, illustrating the need for robust IPv6 protection.
- Pressure on Carrier Mitigation – Direct-path methods accounted for 64% of observed attacks and gained share for a third consecutive half-year, while carpet-bombing grew from 3,97% to 4,54% of attacks, and outbound attacks clearing 1Tbps/1Gpps caused operational impacts. Dedicated mitigation capacity remains the selective layer that providers need to intelligently filter malicious traffic.
- DDoS for Hire and Attack Economics – Attacks lasting one minute or less have roughly doubled as a share since 2H 2023, stressing connection tables, application backends, and resolvers, suggesting DDoS-for-hire platforms are shortening the path to attack.
- Residential Proxy Supply Chain – by pairing residential proxy network tracking with DDoS telemetry, NetScout ASERT identified residential proxy sources participating in DDoS attacks, highlighting that attack traffic can originate from harder-to-distinguish consumer IP addresses.