NETSCOUT logs 609,589 DDoS attacks on South Korea in H1 2026
Carriers absorbed roughly 70% of the attacks, and TCP ACK was the most observed vector with 192,390 strikes, NETSCOUT's report says.
NETSCOUT said it observed 609,589 DDoS attacks targeting South Korea in the first half of 2026, with telecommunications carriers accounting for about 70% of the total, according to a report the security company published on October 23, 2026.
Wireless carriers other than satellite drew about 250,000 attacks and wired carriers about 170,000, for a combined 429,653. Attacks on wired carriers averaged 72 minutes, while those on professional, scientific and technical services averaged 90 minutes. Across all targets, the average attack lasted 25.73 minutes, and a single attack carried as many as 19 vectors.
TCP ACK was the most observed vector with 192,390 attacks, followed by TCP SYN with 88,780 and DNS with 68,722. DNS amplification accounted for 20,020 attacks and TCP RST for 9,477.
Global picture
Worldwide, NETSCOUT's ATLAS platform recorded more than 9.1 million DDoS attacks across 209 countries and regions in the same period. Attacks exceeding 1Tbps or 1Gpps grew 1286% year-on-year, and the first large-scale IPv6 attacks above 1Tbps were observed, with IPv6 mitigation actions up more than 300% year-on-year.
Direct-path attacks made up 64% of observed attacks, rising for three consecutive half-year periods, while carpet-bombing attacks rose from 3.97% to 4.54%. NETSCOUT's ASERT research team said it identified the real origins of residential proxy networks abused in attacks by correlating proxy supply-chain data with real-time DDoS telemetry.
The company says it protects two-thirds of routed global IPv4 address space and monitors over 800Tbps of peering traffic. Hardik Modi is vice president of DDoS solutions engineering and head of ASERT.
Quick answers
How many DDoS attacks hit South Korea in the first half of 2026?
NETSCOUT observed 609,589 attacks targeting South Korea, with carriers accounting for about 70% of them.
Which attack vector was most common in South Korea?
TCP ACK was the most observed vector with 192,390 attacks, ahead of TCP SYN with 88,780 and DNS with 68,722.
How many DDoS attacks were recorded globally?
NETSCOUT observed over 9.1 million DDoS attacks across 209 countries and regions in the same period.