DDoS assaults experienced a decrease during the second quarter of 2025
In the digital landscape of 2025, Distributed Denial of Service (DDoS) attacks have evolved significantly, becoming larger, more frequent, and more precisely targeted. According to Cloudflare's latest report, the first half of 2025 saw an unprecedented surge in DDoS activities, with the company mitigating over 28 million attacks—a staggering increase of 130% compared to the total number of attacks in 2024.
Intensity and Impact
The rise in DDoS attacks is not just quantitative but also qualitative. In 2024, DDoS attacks surged by around 40-41%, a trend that has continued into 2025. One of the most striking developments is the increase in hyper-volumetric attacks, capable of exceeding 1 Terabit per second (Tbps) or 1 billion packets per second. During Q2 2025, Cloudflare recorded 6,500 such attacks, averaging 71 per day.
The shift in targets and sectors is also noteworthy. Retail, healthcare, and websites heavily reliant on APIs have become prime targets, with bot attacks rising 60% on retailers and 39% on APIs in 2024. Healthcare sites reported 100% bot attack exposure.
Moreover, renting DDoS attacks has become extremely cheap, with prices as low as $5 per hour, lowering the barriers to entry for attackers.
Precision and Sophistication
DDoS attacks are no longer just about sheer volume. Attackers are combining massive volumetric floods with precise targeting of web applications, APIs, and cloud infrastructure vulnerabilities. Automated botnets like Gorilla DDoS Botnet continue driving large-scale distributed attacks, overwhelming defenses and evading traditional mechanisms.
Manual penetration testing by attackers uncovers unique vulnerabilities that automated scanners miss, making combined attack vectors more potent.
Strategies to Bypass Defenses
Attackers are employing a variety of strategies to bypass defenses and maximise operational impact.
- Blending Hyper-Volumetric with Application Layer Attacks: High throughput L3/4 attacks are combined with application-level HTTP DDoS attacks exceeding 1 million requests per second, making simple volumetric filtering insufficient.
- Use of Botnets and Automated Tools: Sophisticated botnets automate attack campaigns, targeting entire industries and exploiting widespread vulnerabilities.
- DDoS as a Smoke Screen: Attackers trigger high traffic spikes to mask other malicious activities like data breaches, credential leaks, and configuration exploits.
- Targeting APIs and Cloud Infrastructure: Emphasis on APIs and cloud misconfigurations reflects attackers following the shift to cloud-native architectures, attempting to exploit security gaps rather than just cause denial of service.
The Future of DDoS Attacks
The future of DDoS attacks isn't just about size; it's about strategy, speed, and scale, all at once. Attackers are leveraging hyper-volumetric bursts combined with sophisticated exploitation techniques. They use botnets, multi-vector assaults, and stealth tactics to bypass defenses and maximise operational impact, turning DDoS from mere service disruption into a strategic component of broader cyberattacks.
Cloudflare reported a 68% rise in ransom DDoS incidents, indicating a shift towards more complex and coordinated attacks. The most targeted regions based on customer billing data include China, Brazil, Germany, India, South Korea, and Turkey.
In summary, DDoS attacks in 2025 are larger, more frequent, and more precisely targeted. Attackers are leveraging hyper-volumetric bursts combined with sophisticated exploitation techniques, using botnets, multi-vector assaults, and stealth tactics to bypass defenses and maximise operational impact.
- In the realm of finance and technology, the escalating DDoS attacks are not just about quantity but also quality, as they now include hyper-volumetric attacks that exceed 1 Terabit per second and target critical business sectors such as retail, healthcare, and APIs.
- Strategies for bypassing cybersecurity defenses in the context of data-and-cloud-computing have evolved with attackers using a combination of blending hyper-volumetric attacks with application layer attacks, employing botnets and automated tools, and using DDoS as a smoke screen to mask other malicious activities like data breaches or configuration exploits.
