MeridianMeridian

Netscout 1H 2026 Report: High-Power DDoS Attacks Surge 1,286 Percent as Carpet-Bombing and Residential Proxies Rise

Netscout recorded more than 9.1 million DDoS attacks worldwide in the first half of 2026 across 209 countries and territories. High-performance attacks exceeding 1 Tbps or 1 Gpps increased by 1,286 percent compared with the same period in 2025. Direct-Path attacks accounted for 64 percent of observed incidents, while Carpet-Bombing attacks rose from 3.97 percent to 4.54 percent. The share of attacks lasting one minute or less doubled since the second half of 2023, reaching 3.1 percent. Residential-proxy networks increasingly mask malicious traffic as legitimate user requests, rendering single-IP analysis insufficient. Netscout also documented the first IPv6 attack above 1 Tbps and a more than 300 percent year-over-year increase in active IPv6 mitigation. Organizations are advised to protect networks, applications, and IPv6 infrastructure comprehensively, supplementing on-premises capacity with cloud-based defenses when needed.

Security-InsiderTranslated from German

Read at source

Netscout Threat Intelligence Report for the first half of 2026 shows that high-performance DDoS attacks are rising sharply, yet short and distributed attacks can still disable services. Organizations must secure networks, applications, and IPv6 infrastructure comprehensively.

Worldwide, Netscout registered more than 9.1 million DDoS attacks in 209 countries and territories during the first half of 2026. The number of attacks delivering more than one terabit per second or one billion packets per second grew 1,286 percent compared with the first half of 2025.

High-power attacks challenge existing defenses

Direct-Path attacks represented roughly 64 percent of observed incidents in the first half of 2026, continuing a three-period upward trend. Carpet-Bombing attacks also increased, rising from 3.97 percent to 4.54 percent of total attacks. This technique keeps the load on individual addresses low while placing the overall network under significant stress.

DDoS-for-Hire services lower entry barriers

Commercial DDoS-for-Hire platforms provide standardized interfaces, pre-configured attack methods, and flexible pricing, including free entry-level offers. These services enable actors without deep technical expertise to launch attacks.

Short-duration attacks are gaining importance. The share of attacks lasting at most one minute has doubled since the second half of 2023, reaching 3.1 percent in the first half of 2026. Such brief, targeted strikes can exhaust connection tables, application back-ends, and DNS resolvers without saturating available bandwidth.

Residential proxies hinder detection

Residential-proxy networks route traffic through IP addresses belonging to private or mobile networks. Because the connections resemble ordinary user traffic, malicious activity is difficult to identify by source IP alone. Netscout correlated Residential-proxy intelligence with DDoS telemetry and identified proxy sources involved in attacks, demonstrating that analysis beyond individual IP addresses is required.

IPv6 protection becomes essential

Netscout recorded the first IPv6 attack exceeding one terabit per second. Active mitigation of IPv6 attacks grew more than 300 percent year-over-year, even though the overall share of IPv6 attacks remained stable. This underscores the need for comprehensive IPv6 defenses.

Recommendations for organizations

Enterprises and network operators should detect attacks early and protect both networks and individual applications. When local capacity is insufficient, cloud-based mitigation services can provide additional protection.

NetscoutIPv6
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Using rpcclient from the Samba Suite to Assess and Secure Active Directory Environments
Other

Using rpcclient from the Samba Suite to Assess and Secure Active Directory Environments

The command-line tool rpcclient, part of the Samba suite, enables direct MS-RPC access to Windows systems from Linux. It supports enumeration of domain accounts, shares, and privileges, as well as write operations against SAM and LSA. Originally developed to test Samba's MS-RPC implementation, the utility has become a standard component in the toolkits of pentesters, auditors, and administrators working with Active Directory. From a Linux environment, rpcclient provides access to multiple named pipes including SAM, LSA, NETLOGON, SRVSVC, and SPOOLSS without requiring graphical interfaces. The article demonstrates practical usage through concrete commands against domain controllers and organizes them by common administrative and security-assessment scenarios. This approach allows security teams to perform detailed inventory and privilege analysis directly from the command line.

Security-InsiderNov 2, 2026Translated from German

Hackers Raise Temperatures to 50°C in European Supermarket Refrigeration Systems
Other

Hackers Raise Temperatures to 50°C in European Supermarket Refrigeration Systems

Attackers gained unauthorized access to refrigeration controllers in supermarkets across Sweden, Belgium, Luxembourg, and Estonia, altering temperature settings to as high as +50 °C. In Estonia, the incident involved an outdated Danfoss controller managed by Kitman Coldtech, where the intrusion was detected and stopped within ten minutes, preventing any product loss. The attackers specifically targeted legacy unpatched controllers that had been connected to networks for remote maintenance and monitoring. Similar incidents were reported by Swedish chains ICA and Coop, following earlier attacks in October that caused spoilage in French supermarkets. Experts note that connecting older industrial control systems to the internet for convenience creates significant exposure when remote access is not properly secured.

AntiMalwareNov 2, 2026Translated from Russian

Microsoft Disables PC-to-PC Migration in Windows 11, Pushes OneDrive Backup Instead
Other

Microsoft Disables PC-to-PC Migration in Windows 11, Pushes OneDrive Backup Instead

Microsoft has removed the built-in PC-to-PC Migration feature from Windows 11, making local transfers of files and settings between computers less convenient for home users. The company now directs users toward Windows Backup, which requires uploading data to OneDrive. The change was confirmed in official documentation and implemented through the September update KB5124010. Previously, users could connect two PCs directly via Wi-Fi or Ethernet, verify the link with a one-time code, and select data for transfer without involving Microsoft servers. The new approach relies on cloud synchronization of selected user folders, necessitating a personal Microsoft account and offering only 5 GB of free storage. External drives, USB sticks, and network shares remain available as alternative transfer methods.

AntiMalwareNov 2, 2026Translated from Russian