Netscout says it saw 9.1 million DDoS attacks in the first half of 2026, with events above 1 Tbps or 1 Gpps up 1,286% year over year. The mix also shifted toward direct-path attacks, IPv6, and carpet-bombing, while botnets tied to Aisuru, Kimwolf, and Jackskid kept the volume high.
The mechanism is simple: attackers throw enough packets, requests, or connections at the edge that firewalls, load balancers, or even router line cards run out of processing before the circuit itself fills. In those cases, the service drops because the defense gear is overloaded, not because the link is saturated.
For operators, the important shift is that spare bandwidth is no longer a reassuring signal. If your mitigation depends on coarse blocking or shared edge appliances, a single hot component can take down unrelated customers and services even when the pipe still looks open.