Skip to content

Topic

DDoS Attacks and Mitigation

Distributed denial-of-service attacks that flood online services with traffic, and the mitigation methods—like upstream scrubbing—used to keep sites reachable.

Current stories

securityOne report1 publisher

Netscout ties much of a 1,286% rise in DDoS attacks above 1 Tbps or 1 Gpps to Aisuru-linked botnets

Netscout reports that DDoS attacks exceeding 1 Tbps or 1 Gpps rose 1,286% year over year in the first half of 2026. It says many of these floods exhaust firewalls and load balancers before the link fills.

Reality

Evidence55
Adoption
Not scored
Hype gap+15
Incentives60
Confidence60
securityConfirmed3 publishers

Second DDoS this year disrupts Canonical's ubuntu.com and Ubuntu security advisory API

Canonical confirmed an October 8 DDoS attack on its websites, including ubuntu.com and the Ubuntu security advisory pages and API. OMG! Ubuntu put the downtime at a little over four hours in the second DDoS to hit Canonical this year.

Perspective Coverage

3 publishers
Builder
Builder 22%
Operator
Operator 71%
Investor
Investor 7%

Reality

Evidence58
Adoption
Not scored
Hype gap+8
Incentives
Not scored
Confidence68
securityOne report1 publisher

SkyNet users in St. Petersburg still report outages days into an attack BO Team claimed

SkyNet, a St. Petersburg internet provider, has been under a DDoS attack since October 6, the company said. Ukrainian group BO Team claims it also disabled more than 15,000 devices. SkyNet has not confirmed that.

Publishers:therecord.media

Reality

Evidence55
Adoption
Not scored
Hype gap+20
Incentives70
Confidence50
securityConfirmed3 publishers

Threema went dark for hours. The only users who kept messaging ran it themselves

Large-scale DDoS attacks took the Swiss encrypted messenger offline on Tuesday evening and again Wednesday morning. Customers on Threema On-Prem, running their own infrastructure, saw nothing.

Perspective Coverage

3 publishers
Builder
Builder 28%
Operator
Operator 63%
Investor
Investor 9%

Reality

Evidence68
Adoption
Not scored
Hype gap+12
Incentives50
Confidence65
securityConfirmed4 publishers

Norway's shared login layer failed for the third time since June, and nobody broke in

Three attacks on one shared dependency since June, none attributed. Digdir keeps restoring service, and the attackers keep returning to the single queue everything else waits in.

Perspective Coverage

4 publishers
Builder
Builder 28%
Operator
Operator 62%
Investor
Investor 10%

Reality

Evidence72
Adoption80
Hype gap+15
Incentives35
Confidence70
securityOne report1 publisher

Government-portal DDoS accounts for a quarter of ENISA's 8,257 EU incidents in 2025

ENISA counted 8,257 EU incidents in 2025 and found that denial of service against public-facing services supplies most of the volume, while its warning about compromised technology suppliers rests on one named Swedish case.

Reality

Evidence60
Adoption55
Hype gap+25
Incentives55
Confidence58
securityOne report1 publisher

Wildberries blames its own DDoS defenses for weeks of frozen seller payouts

The marketplace says security measures added after a DDoS attack can suspend transfers while it is under way, which is how some merchants went unpaid for weeks. The sellers' union counts 20 billion rubles outstanding and doubts the account.

Publishers:therecord.media

Reality

Evidence34
Adoption55
Hype gap+16
Incentives82
Confidence44
securityOne report1 publisher

Server Killers hit Norway's public login the day after an 85 billion crown Kyiv pledge

Digdir calls three days of DDoS the biggest it has seen, and says services stayed up nearly throughout. The timing tracks a prime ministerial visit, not the grievance the group published.

Publishers:securityweek.com

Reality

Evidence52
Adoption38
Hype gap+27
Incentives63
Confidence45