NetScout reports over 9.1M DDoS attacks in first half of 2026
Very large attacks above 1Tbps or 1Gpps rose 1,286% year on year, and an IPv6 attack exceeding 1Tbps was observed for the first time, according to NetScout's DDoS Threat Intelligence Report.
NetScout has published its DDoS Threat Intelligence Report for the first half of 2026, recording more than 9.1 million DDoS attacks worldwide between January and June 2026, according to dailysecu.com.
The report shows a sharp rise in very large attacks: those exceeding 1Tbps or 1Gpps increased 1,286% compared with the same period a year earlier. An IPv6 attack exceeding 1Tbps was observed for the first time, and active mitigations against IPv6 attacks rose more than 300% year on year.
Direct-path attacks accounted for 64% of all attacks. Short-duration attacks lasting under one minute roughly doubled since the second half of 2023.
NetScout also highlighted abuse of residential proxy supply chains, which made attack traffic originate from consumer IP addresses.
South Korea data
In South Korea, 609,589 DDoS attacks were observed in the first half of 2026, with an average duration of 25.73 minutes. TCP ACK attacks were the most used vector in Korea at 192,390 cases, followed by TCP SYN at 88,780 and DNS at 68,722. Wireless telecom carriers were hit 254,897 times and wired carriers 174,756 times.
NetScout advised carriers and enterprises to expand scrubbing capacity at network edges.
Quick answers
How many DDoS attacks were recorded worldwide in the first half of 2026?
NetScout observed more than 9.1 million DDoS attacks between January and June 2026.
What was the most used DDoS attack vector in South Korea?
TCP ACK attacks were the most used vector in Korea at 192,390 cases, followed by TCP SYN at 88,780 and DNS at 68,722.
Did large DDoS attacks increase in the first half of 2026?
Yes, attacks exceeding 1Tbps or 1Gpps rose 1,286% compared with the same period a year earlier.