A surge in politically motivated cyber aggression, defined by ever bolder hacktivist campaigns and state-backed actors weaponising DDoS attacks, is exposing organisations around the world to unprecedented risk, new research from NetScout warns.

The cybersecurity firm’s latest DDoS Threat Intelligence Report charts the rapid escalation of these assaults, with the first half of this year seeing more than eight million DDoS attacks, with more than fifty reaching more than a terabit-per-second (Tbps), as well as multiple gigapacket-per-second attacks.

Among the most devastating NetScout observed was a 3.12 Tbps attack in the Netherlands and a 1.5 Gbps attack in the United States, while the UK suffered more than one hundred thousand DDoS attacks over the last six months alone.

However, the EMEA region has borne the brunt of attacks, reaching a peak of 3.2 million, by far the most DDoS assaults that NetScope witnessed, with Germany and the Netherlands being the most vulnerable. 

While automation, multi-vector attacks, and carpet-bombing techniques continue to challenge traditional defences, botnets remain one of the most significant threats.

Comprising tens of thousands of IoT devices, servers, and routers, these botnets represent the ‘operational backbone’ of DDoS warfare, with NetScout tracking more than 880 bot-driven DDoS attacks occurring daily by March, peaking at 1,600 incidents, with durations increasing to an average of eighteen minutes.

The data shows that hacktivist groups orchestrated hundreds of these coordinated strikes each month, targeting the communications, transportation, energy, and defence sectors, with spikes seemingly driven by geopolitical events.

For example, the India-Pakistan conflict saw hacktivist groups target the Indian government and financial sectors in May, while the Iran-Israel conflict generated more than 15,000 attacks against Iran and 279 against Israel in June. 

Even the World Economic Forum, held in Switzerland last January, proved to be a tempting target, with NetScout seeing a surge in DDoS attacks during the event’s commencement and closing events.

As to the attackers themselves, the NoName057(16) collective was particularly dominant, as in previous studies, claiming more than 475 attacks in March alone, 337 % more than the next most active group, and targeting government websites across Italy, Spain, Taiwan, and Ukraine.

Recommended reading

• Hackers Unleash ‘Company Killing’ DDoS Attack
• DDoS Attacks Surge 2,844% in Conflict Zones, Report Claims
• Report: DDoS Attacks Spike 82% in 2024

However, the report also highlights a new player on the DDoS scene, the hacktivist group DieNet. NetScope claims that this newly formed collective was behind sixty DDoS attacks, targeting critical infrastructure across the globe in what have been identified as ideologically motivated attacks.

Despite only debuting in March this year, the group has targeted the transportation, energy, medical systems, and digital commerce sectors, proving that new threat actors are finding it easier than ever to make a big impact. 

“As hacktivist groups leverage more automation, shared infrastructure, and evolving tactics, organisations must recognise that traditional defences are no longer sufficient,” stated Richard Hummel, director of threat intelligence at NetScout.

“The integration of AI assistants and the use of large language models, such as WormGPT and FraudGPT, escalates that concern. Organisations need intelligence-driven, proven DDoS defences that can deal with the sophisticated attacks we see today.”