Loading story…
Link11's latest report reveals a 225% increase in DDoS attacks in the first half of 2025 compared to the previous year, with attackers employing more sophisticated and prolonged methods. The attacks reached volumes of 438 terabytes and included advanced Layer 7 techniques that mimic legitimate traffic, as well as politically motivated campaigns by groups like NoName057(16). The report urges organizations to adopt real-time monitoring, AI-driven defenses, and robust contingency planning to counter these evolving threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
securitysenses.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DDoS attack volumes have surged by 41% in the first half of 2025 compared to the previous year, with the largest recorded attack peaking at 2.2 Tbps, according to Gcore's latest Radar report. Attackers are increasingly targeting the technology and financial sectors, shifting away from gaming, and are employing more sophisticated tactics that combine high-volume assaults with application-layer manipulation. The duration of attacks is also increasing, with a notable rise in assaults lasting between 10 and 30 minutes. These trends underscore the urgent need for organizations to strengthen their DDoS detection and mitigation capabilities to address the growing scale and complexity of threats.
Jun 29, 2026
Link11, a European web infrastructure security provider, has released an analysis identifying five major cybersecurity trends expected to shape defense strategies for organizations across Europe in 2026. The report highlights the increasing use of DDoS attacks as diversionary tactics, where attackers leverage these disruptions to mask more damaging activities such as network infiltration, data theft, or covert malware deployment. The findings are based on current threat activity, industry research, and insights from the Link11 European Cyber Report, as well as broader market indicators like PwC’s Global Digital Trust Insights 2026, which notes that geopolitical instability and underinvestment in proactive security measures are leaving critical gaps for attackers to exploit. The report urges European organizations to strengthen their incident response frameworks, treating any DDoS alert as a potential indicator of more serious, concurrent threats. The evolving threat landscape, marked by rapid advances in artificial intelligence and fractured supply chains, is driving a need for more robust monitoring, testing, and hardening of defenses. Link11's insights are intended to guide organizations in preparing for the complex and sophisticated cyber operations anticipated in the coming year, emphasizing the importance of proactive and comprehensive security strategies.
Jun 29, 2026
A March multinational operation involving the United States, Canada, and Germany disrupted infrastructure supporting the Aisiru and Kimwolf botnets, contributing to a fall in the largest observed botnet from 13.5 million devices in Q1 2026 to 2.09 million in Q2. Link11 also reported a 42% decline in DDoS attacks in Europe during the first half of 2026, partly attributing the reduction to law-enforcement actions including Operation Eastwood and the shutdown of four IoT botnets. Attackers are compensating with more powerful and resilient campaigns: Link11 recorded peaks of **2.3 Tbit/s** and **322 million packets per second**, with 705 TB of cumulative malicious traffic, driven by super-botnets and hijacked cloud servers. Operators are increasingly dispersing traffic sources and adopting decentralized command infrastructure; the Aeternum and Void botnets use Polygon and Ethereum smart contracts for C2 distribution. DDoS surges are also being used to conceal SQL-injection and XSS probing, requiring defenses that combine continuous traffic inspection, behavioral detection, adaptive filtering, and application-layer monitoring.
Sep 4, 2026