NETSCOUT Systems (NETSCOUT) revealed that it detected more than 9.1 million distributed denial-of-service (DDoS) attacks worldwide between January and June 2026, across 209 countries and territories. The first-half threat intelligence report indicates that the risk is no longer linked solely to traffic volume, but also extends to the number of targeted locations, attack speed, and the ability to disrupt services without completely exhausting connection capacity.
Surge in High-Volume Attacks
The number of attacks exceeding 1 terabit per second or 1 gigabit per second increased by 1,286% year over year. NETSCOUT believes this increase makes high-volume attacks a recurring phenomenon rather than exceptional cases, increasing pressure on service providers and organizations responsible for maintaining the continuity of digital platforms.
The company also detected the first IPv6 attack to exceed the 1-terabit-per-second threshold, at a time when efforts to counter IPv6 attacks increased by more than 300% year over year, despite their share of total attacks remaining nearly stable. These data highlight the need for security teams to develop capabilities specifically designed to handle IPv6 traffic, rather than assuming that current security tools cover both protocols with the same effectiveness.
Shorter Attacks That Are More Difficult to Detect
Direct-path methods accounted for 64% of observed attacks, while the share of what the report described as “highly intensive random attacks” rose from 3.97% to 4.54%. Since the second half of 2023, the proportion of attacks lasting one minute or less has nearly doubled, placing pressure on connection tables, application back-end systems, and domain name analysis servers.
The report links this shift to the spread of rented distributed denial-of-service services, which shorten the path for attackers and enable the execution of brief, high-intensity attacks. The difficulty with this pattern is that the short attack duration may limit opportunities to detect and respond to it before it ends, while still leaving an operational impact on connected services.
What Does This Mean for Network Teams?
The report concludes that relying solely on traditional network control tools is no longer sufficient. According to NETSCOUT, dealing with large, fast, and multi-location attacks requires more precise and selective traffic-filtering capabilities, along with enhanced scrubbing capabilities at network edges.
ASERT data adds another dimension to the problem, as the team was able to identify residential sources involved in carrying out DDoS attacks by combining residential IP address network tracking with attack measurement data. This means that some attack traffic may originate from addresses that appear similar to ordinary user traffic, increasing the challenge of distinguishing malicious activity from legitimate traffic.
NETSCOUT says the report’s indicators are based on attack traffic that it directly observed and verified, measuring the highest bit-per-second and packet-per-second rates at specific stages of monitoring and mitigation. These findings remain indicators produced through the company’s methodology and observed data, but they clearly show that attack speed, short duration, and source diversity have become central factors in planning network defenses during 2026.