13.5 Million-Device Botnet Powers 2 Tbps DDoS Attacks on FinTech

Qrator Labs reported that the largest botnet it tracks grew from roughly 1.33 million devices in March 2025 to 13.5 million devices in Q1 2026, driving a new wave of massive distributed denial-of-service attacks against financially focused organizations. The firm said FinTech, banks, and payment systems were the most targeted sectors, as attackers increasingly combined L3/L4 and L7 techniques in larger, more complex multi-vector campaigns. It also recorded a rise in bad-bot activity, with an average of 2.5 billion blocked requests per month.

One of the most significant incidents hit the betting industry in mid-March, peaking at 2.065 Tbps and nearly 1 billion packets per second over about 40 minutes, with attackers shifting tactics 11 times during the assault. Qrator linked the broader trend to evolving botnet tradecraft, including a new loader called Aeternum C2 that uses the Polygon blockchain for decentralized command-and-control, and to the continued evolution of large-scale botnet operations previously associated with record-setting campaigns such as Mēris.