Report by NETSCOUT
DDoS Threat Intelligence Report
Key Findings
Hacktivist groups like NoName057(16) orchestrated hundreds of coordinated DDoS attacks each month.
There were multiple gigapacket-per-second (Gpps) DDoS attacks in the first half of 2025.
A 3.12 Tbps DDoS attack occurred in the Netherlands in the first half of 2025.
The Iran-Israel conflict generated more than 15,000 DDoS attacks against Iran in June.
Bot-driven DDoS incidents peaked at 1,600 in March.
Attack durations for bot-driven DDoS attacks increased to an average of 18 minutes.
More than 50 DDoS attacks were greater than a terabit-per-second (Tbps) in the first half of 2025.
NETSCOUT monitored more than 8 million DDoS attacks globally in the first half of 2025.
More than 3.2 million DDoS attacks in the first half of 2025 occurred in EMEA.
More than 880 bot-driven DDoS attacks occurred daily in March.
DieNet orchestrated over 60 DDoS attacks since March.
A 1.5 Gpps DDoS attack occurred in the United States.
The Iran-Israel conflict generated 279 DDoS attacks against Israel in June.
Keymous+ launched 73 DDoS attacks across 28 industry sectors in 23 countries since March.
NoName057(16) claimed more than 475 DDoS attacks in March alone. This was 337% more than the next most active group.
NETSCOUT monitored more than 8 million DDoS attacks globally in the first half of 2025.