{"success":true,"data":{"pressRelease":{"id":"168551","rtpr_id":"nBw4FRJn8a-20261014","ticker":"NTCT","exchange":"NASDAQ","all_tickers":["NTCT"],"title":"High-Capacity DDoS Attacks Surge 1,286% in 1H 2026 According to NETSCOUT Threat Intelligence Research","author":"Business Wire","published_at":"2026-10-14T10:05:00.092Z","article_body":"High-Capacity DDoS Attacks Surge 1,286% in 1H 2026 According to NETSCOUT\nThreat Intelligence Research\n\nMassive 1Tbps Events and Weaponized Residential Proxies Expose Critical\nMitigation Gaps, Forcing Organizations to Rethink Enterprise and Carrier\nDefenses\n\nNETSCOUT(®) SYSTEMS, INC. (NASDAQ: NTCT) released its first half 2026\nDistributed Denial-of-Service (DDoS) Threat Intelligence Report\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.netscout.com%2Fthreatreport%2F&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=2026+Distributed+Denial-of-Service+%28DDoS%29+Threat+Intelligence+Report&index=1&md5=5129b0b15f0f779920c933f7f8ef7edc)\n, revealing a significant shift in how attacks are launched and sourced. With\nmore than 9.1 million DDoS attacks recorded globally by NETSCOUT between\nJanuary and June 2026, the report highlights that DDoS risk is growing along\nthree axes: the volume of traffic that must be inspected, the number of places\nwhere mitigation must be deployed, and the share of attacks that disrupt\nservice without ever saturating a link.\n\n“The 1,286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity\nevents are no longer anomalies; they are routine,” stated Hardik Modi, VP\nEngineering, DDoS Solutions, and ASERT Threat Intelligence Team, NETSCOUT.\n“With the proliferation of residential proxies and short, rate-based attacks\nfrom DDoS-for-hire platforms, traditional coarse network controls are\ninsufficient. Providers and enterprises alike need finer-grained, selective\nmitigation and increased scrubbing capacity at network edges to combat these\nqualitative shifts in attack sophistication.”\n\nKey findings include:\n\n\n * Massive Attacks on a Global Scale – NETSCOUT ATLAS recorded more than 9.1\nmillion DDoS attacks across 209 countries and territories, underscoring the\nexpanding operational risk to enterprises and providers.\n\n * Surge in High-Impact Capacity – Attacks exceeding 1Tbps or 1Gpps increased\n1,286% year over year, suggesting defenders must continue to prepare for\ngreater attack intensity.\n\n * IPv6 crossed the terabit threshold – NETSCOUT observed its first IPv6 attack\nexceeding 1Tbps, while active mitigation of IPv6 attacks rose by more than\n300% year over year even as IPv6’s share of attacks remained roughly flat,\nillustrating the need for robust IPv6 protection.\n\n * Pressure on Carrier Mitigation – Direct-path methods accounted for 64% of\nobserved attacks and gained share for a third consecutive half-year, while\ncarpet-bombing grew from 3.97% to 4.54% of attacks, and outbound attacks\nclearing 1Tbps/1Gpps caused operational impacts. Dedicated mitigation capacity\nremains the selective layer that providers need to intelligently filter\nmalicious traffic.\n\n * DDoS for Hire and Attack Economics – Attacks lasting one minute or less have\nroughly doubled as a share since 2H 2023, stressing connection tables,\napplication backends, and resolvers, suggesting DDoS-for-hire platforms are\nshortening the path to attack.\n\n * Residential Proxy Supply Chain – by pairing residential proxy network\ntracking with DDoS telemetry, NETSCOUT ASERT identified residential proxy\nsources participating in DDoS attacks, highlighting that attack traffic can\noriginate from harder-to-distinguish consumer IP addresses.\n\nNETSCOUT maps the DDoS landscape through passive, active, and reactive vantage\npoints, providing unparalleled visibility into global attack trends. For more\nthan 15 years, NETSCOUT has delivered trusted, consistent DDoS Intelligence\nbased exclusively on directly observed, verifiable attack traffic. NETSCOUT\ndoes not aggregate multiple alerts or geographically distributed events into\ncomposite peak values, which ensures accuracy, repeatability, and true\ncomparability across reporting periods. Peak metrics reflect single-second\nmaximum bits-per-second (bps) and packets-per-second (pps) rates measured at\ndefined mitigation and monitoring points.\n\nFrom Verified DDoS Intelligence to Layered Protection\n\nNETSCOUT protects two-thirds of the routed IPv4 space, securing network edges\nthat carried global peak traffic of over 800 Tbps. It monitors tens of\nthousands of daily DDoS attacks by tracking multiple botnets and DDoS-for-hire\nservices that leverage millions of abused or compromised devices. NETSCOUT\nARBOR Cloud, backed by ATLAS visibility and dedicated DDoS mitigation\ncapacity, complements on-premises defenses and helps organizations absorb\nlarge, distributed attacks before they overwhelm critical services.\n\nThese findings show why DDoS resilience now depends on more than stopping the\nlargest attack. Organizations need to recognize changing attack sources and\nmethods, mitigate both inbound and outbound attacks, apply precise protection\nwhere services are exposed, and draw on cloud capacity when attacks exceed\nlocal defenses. NETSCOUT combines directly observed ATLAS intelligence with\non-premises and cloud-delivered mitigation to help customers protect service\navailability and sustain the digital operations their businesses depend on.\n\nResources:\n\n\n * Download the \nNETSCOUT 1H 2026 DDoS Threat Intelligence Report\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.netscout.com%2Fthreatreport%2F&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=NETSCOUT+1H+2026+DDoS+Threat+Intelligence+Report&index=2&md5=94a2641a544c9153d7e090bf2c5d24fb)\n\n * See real-time DDoS attack stats and insights at \nNETSCOUT Cyber Threat Horizon\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fhorizon.netscout.com%2F&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=NETSCOUT+Cyber+Threat+Horizon&index=3&md5=60e599162932ec507766ad54eada3464)\n\n * Learn more about \nNETSCOUT Arbor DDoS Protection Services\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.netscout.com%2Fddos-protection&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=NETSCOUT+Arbor+DDoS+Protection+Services&index=4&md5=53340d59e395cfa827354bc2e9da22d5)\n\nAbout NETSCOUT\n\nNETSCOUT SYSTEMS, INC. (NASDAQ: NTCT) protects the connected world from\ncyberattacks and performance and availability disruptions through its unique\nvisibility platform and solutions powered by its pioneering deep packet\ninspection at scale technology. As a leading provider of network\nobservability, AIOps, carrier service assurance, cybersecurity, and\nDistributed Denial-of-Service (DDoS) attack protection solutions, NETSCOUT\nserves the world’s largest enterprises, service providers, and public sector\norganizations. Learn more at www.netscout.com\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fwww.netscout.com&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=www.netscout.com&index=5&md5=e261de91a7f1253ed8441b7b296dda43)\nor follow @NETSCOUT on LinkedIn\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fnetscout%2F&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=LinkedIn&index=6&md5=71f375cfe60095f6c1d14ab130105562)\n, X\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Ftwitter.com%2FNETSCOUT&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=X&index=7&md5=07e907203325716113da1bd3fe015607)\n, or Facebook\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.facebook.com%2FNETSCOUTinc&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=Facebook&index=8&md5=6702cac4851e0fc3ee893fdf97dce633)\n.\n\n©2026 NETSCOUT SYSTEMS, INC. All rights reserved. Third-party trademarks\nmentioned are the property of their respective owners.\n\n\n\nView source version on businesswire.com:\nhttps://www.businesswire.com/news/home/20261014786503/en/\n(https://www.businesswire.com/news/home/20261014786503/en/)\n\nEditorial Contacts: \n\nChris Lucas\n\nNETSCOUT SYSTEMS, INC.\n\n+1 978 614 4124\n\nChris.Lucas@netscout.com \n(mailto:Chris.Lucas@netscout.com) \n\n\nChris Shattuck\n\nFinn Partners for NETSCOUT\n\n+1 404 502 6755\n\nNETSCOUT-US@FinnPartners.com (mailto:NETSCOUT-US@FinnPartners.com)\n\n\nCopyright Business Wire 2026","article_body_html":"","raw_payload":{"data":{"id":"nBw4FRJn8a-20261014","title":"High-Capacity DDoS Attacks Surge 1,286% in 1H 2026 According to NETSCOUT Threat Intelligence Research","author":"Business Wire","ticker":"NTCT","created":"2026-10-14T10:05:00.092Z","tickers":["NTCT"],"exchange":"NASDAQ","article_body":"High-Capacity DDoS Attacks Surge 1,286% in 1H 2026 According to NETSCOUT\nThreat Intelligence Research\n\nMassive 1Tbps Events and Weaponized Residential Proxies Expose Critical\nMitigation Gaps, Forcing Organizations to Rethink Enterprise and Carrier\nDefenses\n\nNETSCOUT(®) SYSTEMS, INC. (NASDAQ: NTCT) released its first half 2026\nDistributed Denial-of-Service (DDoS) Threat Intelligence Report\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.netscout.com%2Fthreatreport%2F&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=2026+Distributed+Denial-of-Service+%28DDoS%29+Threat+Intelligence+Report&index=1&md5=5129b0b15f0f779920c933f7f8ef7edc)\n, revealing a significant shift in how attacks are launched and sourced. With\nmore than 9.1 million DDoS attacks recorded globally by NETSCOUT between\nJanuary and June 2026, the report highlights that DDoS risk is growing along\nthree axes: the volume of traffic that must be inspected, the number of places\nwhere mitigation must be deployed, and the share of attacks that disrupt\nservice without ever saturating a link.\n\n“The 1,286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity\nevents are no longer anomalies; they are routine,” stated Hardik Modi, VP\nEngineering, DDoS Solutions, and ASERT Threat Intelligence Team, NETSCOUT.\n“With the proliferation of residential proxies and short, rate-based attacks\nfrom DDoS-for-hire platforms, traditional coarse network controls are\ninsufficient. Providers and enterprises alike need finer-grained, selective\nmitigation and increased scrubbing capacity at network edges to combat these\nqualitative shifts in attack sophistication.”\n\nKey findings include:\n\n\n * Massive Attacks on a Global Scale – NETSCOUT ATLAS recorded more than 9.1\nmillion DDoS attacks across 209 countries and territories, underscoring the\nexpanding operational risk to enterprises and providers.\n\n * Surge in High-Impact Capacity – Attacks exceeding 1Tbps or 1Gpps increased\n1,286% year over year, suggesting defenders must continue to prepare for\ngreater attack intensity.\n\n * IPv6 crossed the terabit threshold – NETSCOUT observed its first IPv6 attack\nexceeding 1Tbps, while active mitigation of IPv6 attacks rose by more than\n300% year over year even as IPv6’s share of attacks remained roughly flat,\nillustrating the need for robust IPv6 protection.\n\n * Pressure on Carrier Mitigation – Direct-path methods accounted for 64% of\nobserved attacks and gained share for a third consecutive half-year, while\ncarpet-bombing grew from 3.97% to 4.54% of attacks, and outbound attacks\nclearing 1Tbps/1Gpps caused operational impacts. Dedicated mitigation capacity\nremains the selective layer that providers need to intelligently filter\nmalicious traffic.\n\n * DDoS for Hire and Attack Economics – Attacks lasting one minute or less have\nroughly doubled as a share since 2H 2023, stressing connection tables,\napplication backends, and resolvers, suggesting DDoS-for-hire platforms are\nshortening the path to attack.\n\n * Residential Proxy Supply Chain – by pairing residential proxy network\ntracking with DDoS telemetry, NETSCOUT ASERT identified residential proxy\nsources participating in DDoS attacks, highlighting that attack traffic can\noriginate from harder-to-distinguish consumer IP addresses.\n\nNETSCOUT maps the DDoS landscape through passive, active, and reactive vantage\npoints, providing unparalleled visibility into global attack trends. For more\nthan 15 years, NETSCOUT has delivered trusted, consistent DDoS Intelligence\nbased exclusively on directly observed, verifiable attack traffic. NETSCOUT\ndoes not aggregate multiple alerts or geographically distributed events into\ncomposite peak values, which ensures accuracy, repeatability, and true\ncomparability across reporting periods. Peak metrics reflect single-second\nmaximum bits-per-second (bps) and packets-per-second (pps) rates measured at\ndefined mitigation and monitoring points.\n\nFrom Verified DDoS Intelligence to Layered Protection\n\nNETSCOUT protects two-thirds of the routed IPv4 space, securing network edges\nthat carried global peak traffic of over 800 Tbps. It monitors tens of\nthousands of daily DDoS attacks by tracking multiple botnets and DDoS-for-hire\nservices that leverage millions of abused or compromised devices. NETSCOUT\nARBOR Cloud, backed by ATLAS visibility and dedicated DDoS mitigation\ncapacity, complements on-premises defenses and helps organizations absorb\nlarge, distributed attacks before they overwhelm critical services.\n\nThese findings show why DDoS resilience now depends on more than stopping the\nlargest attack. Organizations need to recognize changing attack sources and\nmethods, mitigate both inbound and outbound attacks, apply precise protection\nwhere services are exposed, and draw on cloud capacity when attacks exceed\nlocal defenses. NETSCOUT combines directly observed ATLAS intelligence with\non-premises and cloud-delivered mitigation to help customers protect service\navailability and sustain the digital operations their businesses depend on.\n\nResources:\n\n\n * Download the \nNETSCOUT 1H 2026 DDoS Threat Intelligence Report\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.netscout.com%2Fthreatreport%2F&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=NETSCOUT+1H+2026+DDoS+Threat+Intelligence+Report&index=2&md5=94a2641a544c9153d7e090bf2c5d24fb)\n\n * See real-time DDoS attack stats and insights at \nNETSCOUT Cyber Threat Horizon\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fhorizon.netscout.com%2F&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=NETSCOUT+Cyber+Threat+Horizon&index=3&md5=60e599162932ec507766ad54eada3464)\n\n * Learn more about \nNETSCOUT Arbor DDoS Protection Services\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.netscout.com%2Fddos-protection&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=NETSCOUT+Arbor+DDoS+Protection+Services&index=4&md5=53340d59e395cfa827354bc2e9da22d5)\n\nAbout NETSCOUT\n\nNETSCOUT SYSTEMS, INC. (NASDAQ: NTCT) protects the connected world from\ncyberattacks and performance and availability disruptions through its unique\nvisibility platform and solutions powered by its pioneering deep packet\ninspection at scale technology. As a leading provider of network\nobservability, AIOps, carrier service assurance, cybersecurity, and\nDistributed Denial-of-Service (DDoS) attack protection solutions, NETSCOUT\nserves the world’s largest enterprises, service providers, and public sector\norganizations. Learn more at www.netscout.com\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=http%3A%2F%2Fwww.netscout.com&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=www.netscout.com&index=5&md5=e261de91a7f1253ed8441b7b296dda43)\nor follow @NETSCOUT on LinkedIn\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fnetscout%2F&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=LinkedIn&index=6&md5=71f375cfe60095f6c1d14ab130105562)\n, X\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Ftwitter.com%2FNETSCOUT&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=X&index=7&md5=07e907203325716113da1bd3fe015607)\n, or Facebook\n(https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.facebook.com%2FNETSCOUTinc&esheet=54621209&newsitemid=20261014786503&lan=en-US&anchor=Facebook&index=8&md5=6702cac4851e0fc3ee893fdf97dce633)\n.\n\n©2026 NETSCOUT SYSTEMS, INC. All rights reserved. Third-party trademarks\nmentioned are the property of their respective owners.\n\n\n\nView source version on businesswire.com:\nhttps://www.businesswire.com/news/home/20261014786503/en/\n(https://www.businesswire.com/news/home/20261014786503/en/)\n\nEditorial Contacts: \n\nChris Lucas\n\nNETSCOUT SYSTEMS, INC.\n\n+1 978 614 4124\n\nChris.Lucas@netscout.com \n(mailto:Chris.Lucas@netscout.com) \n\n\nChris Shattuck\n\nFinn Partners for NETSCOUT\n\n+1 404 502 6755\n\nNETSCOUT-US@FinnPartners.com (mailto:NETSCOUT-US@FinnPartners.com)\n\n\nCopyright Business Wire 2026"},"type":"article","timestamp":"2026-10-14T10:05:00.129612442Z","server_sent_at_ms":1791972300129},"received_at":"2026-10-14T10:05:00.180Z","source_url":"https://www.businesswire.com/news/home/20261014786503/en/"},"analysis":{"id":"156816","press_release_id":"168551","analysis_json":{"industry":{"label":"Software","sector":"Information Technology"},"redFlags":[],"eventType":"other","narrative":"NETSCOUT released its 1H 2026 DDoS Threat Intelligence Report, recording more than 9.1 million DDoS attacks globally across 209 countries and territories between January and June 2026.\n\nAttacks exceeding 1Tbps or 1Gpps surged 1,286% year over year, and the company observed its first IPv6 attack above the terabit threshold, driven partly by DDoS-for-hire platforms and weaponized residential proxies.\n\nThe release functions as thought leadership supporting demand for NETSCOUT's Arbor DDoS mitigation products, with no financial results, guidance, or contracts disclosed.","sentiment":"neutral","agentHooks":{"shouldPost":false,"suggestedAngle":"Escalating DDoS attack intensity underscores demand tailwinds for NETSCOUT's Arbor mitigation business, but this is vendor research rather than material news."},"keyFigures":{"customDimensions":{"countries_covered":209,"ddos_attacks_1h2026":"9.1 million","carpet_bombing_share":"4.54% (up from 3.97%)","protected_ipv4_share":"two-thirds of routed IPv4 space","direct_path_attack_share":"64%","ipv6_mitigation_growth_yoy":"300%","global_peak_traffic_secured":"over 800 Tbps","high_capacity_attack_growth_yoy":"1,286%"}},"quotedText":"The 1,286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine","namedEntities":{"people":[{"name":"Hardik Modi","role":"VP Engineering, DDoS Solutions, and ASERT Threat Intelligence Team, NETSCOUT"},{"name":"Chris Lucas","role":"Editorial contact, NETSCOUT"},{"name":"Chris Shattuck","role":"Finn Partners for NETSCOUT"}],"products":["NETSCOUT ARBOR Cloud","ATLAS","Arbor DDoS Protection Services","NETSCOUT Cyber Threat Horizon","DDoS Threat Intelligence Report"],"companies":[{"name":"NETSCOUT SYSTEMS, INC.","ticker":"NTCT","relationship":"filer/report author"},{"name":"Finn Partners","relationship":"PR agency"}],"dollarAmounts":[]},"materialImpact":{"score":2,"reasoning":"This is a vendor threat-intelligence report promoting NETSCOUT's DDoS expertise and Arbor products. It reinforces the company's thought leadership and demand tailwinds for DDoS mitigation but contains no financial results, guidance, or contractual news."},"tickerRelevance":{"others":[],"primary":"NTCT"},"globalImportance":20,"audienceRelevance":25,"eventTypeSecondary":[],"importanceComponents":{"tickerTier":"mid-cap","eventGravity":"vendor-threat-report","sectorWeight":"cybersecurity","issuerAuthored":true}},"event_type":"other","event_type_secondary":null,"sentiment":"neutral","material_impact_score":2,"narrative":"NETSCOUT released its 1H 2026 DDoS Threat Intelligence Report, recording more than 9.1 million DDoS attacks globally across 209 countries and territories between January and June 2026.\n\nAttacks exceeding 1Tbps or 1Gpps surged 1,286% year over year, and the company observed its first IPv6 attack above the terabit threshold, driven partly by DDoS-for-hire platforms and weaponized residential proxies.\n\nThe release functions as thought leadership supporting demand for NETSCOUT's Arbor DDoS mitigation products, with no financial results, guidance, or contracts disclosed.","key_figures":{"customDimensions":{"countries_covered":209,"ddos_attacks_1h2026":"9.1 million","carpet_bombing_share":"4.54% (up from 3.97%)","protected_ipv4_share":"two-thirds of routed IPv4 space","direct_path_attack_share":"64%","ipv6_mitigation_growth_yoy":"300%","global_peak_traffic_secured":"over 800 Tbps","high_capacity_attack_growth_yoy":"1,286%"}},"named_entities":{"people":[{"name":"Hardik Modi","role":"VP Engineering, DDoS Solutions, and ASERT Threat Intelligence Team, NETSCOUT"},{"name":"Chris Lucas","role":"Editorial contact, NETSCOUT"},{"name":"Chris Shattuck","role":"Finn Partners for NETSCOUT"}],"products":["NETSCOUT ARBOR Cloud","ATLAS","Arbor DDoS Protection Services","NETSCOUT Cyber Threat Horizon","DDoS Threat Intelligence Report"],"companies":[{"name":"NETSCOUT SYSTEMS, INC.","ticker":"NTCT","relationship":"filer/report author"},{"name":"Finn Partners","relationship":"PR agency"}],"dollarAmounts":[]},"model_name":"glm-5.3-flashx","prompt_hash":"sha256:5c812bd9e28b810d","schema_hash":"sha256:05005c02d9cffac9","created_at":"2026-10-14T10:05:05.944Z","global_importance":20,"audience_relevance":25,"importance_components":{"tickerTier":"mid-cap","eventGravity":"vendor-threat-report","sectorWeight":"cybersecurity","issuerAuthored":true}},"durationMs":5750,"modelName":"glm-5.3-flashx"}}