A few years ago, the power of DDoS-atabs of 1 terabit per second was considered a rarity and a reason for individual reports - now, according to CURATOR, such attacks have become a routine practice of intruders. The DDoS protection provider summed up the results of the first half of 2026 and recorded a sharp increase in the number of teratbital attacks: in April-June, 12 such incidents were neutralized - twice as many as in the whole of 2025.
The picture of the targets has also changed. Fintech remains the most attacked industry, but its share has decreased from 44.2% to 31.9%. At the same time, activity sharply increased against the media segment - TV channels, radio stations and bloggers: for the quarter it came out on top among the microsegments with a share of 12.7% of all incidents. The top five most attacked destinations also included payment systems, banks, online bookmakers and trading platforms.
The most powerful attacks of the quarter fell on the online betting segment: the peak speed of the two largest reached 1.64 and 1.58 terabit per second when transmitting up to 638 million packets of data per second. The longest was the attack on the segment of online retail - it lasted almost 80 hours.
Attacks become not only more powerful, but also more complicated technically. The share of multi-vector attacks, when attackers simultaneously use several methods of overloading servers, increased from 8.0% in 2025 to 11.7%. The share of attacks such as UDP flood, TCP flood and SYN flood has increased significantly – all based on sending a huge number of fake network queries that prevent the server from serving real users. Separately, there is a sharp jump in ICMP flood attacks - from 0.1% to 4.3%.
At the same time, the largest of the observed botnets for the first time in two years sharply decreased: from 13.5 million devices in the first quarter to 2.09 million in the second. CURATOR attribute this to a joint operation of law enforcement agencies of the United States, Canada and Germany, during which the infrastructure of the Aisuru and Kimwolf botnets was disrupted. The United States now accounts for the largest share of the sources of attacks - 15.9%.
Despite the operation against two large ботнетовbotnets, CURATOR experts do not expect a long-term threat reduction: the number of vulnerable devices continues to grow, and the tools for organizing attacks based on artificial intelligence are becoming more accessible.
At the same time, the sources of attacks are distributed around the world more and more evenly, which reduces the benefits of blocking traffic on a geographical basis - experts consider this measure of protection to be less and less effective. As a more reliable approach, the report highlights the comprehensive protection of the resource, not tied to industry assumptions: the threat of sharp spikes in traffic is relevant for any public website or service, regardless of its scope of activity.
The picture of the targets has also changed. Fintech remains the most attacked industry, but its share has decreased from 44.2% to 31.9%. At the same time, activity sharply increased against the media segment - TV channels, radio stations and bloggers: for the quarter it came out on top among the microsegments with a share of 12.7% of all incidents. The top five most attacked destinations also included payment systems, banks, online bookmakers and trading platforms.
The most powerful attacks of the quarter fell on the online betting segment: the peak speed of the two largest reached 1.64 and 1.58 terabit per second when transmitting up to 638 million packets of data per second. The longest was the attack on the segment of online retail - it lasted almost 80 hours.
Attacks become not only more powerful, but also more complicated technically. The share of multi-vector attacks, when attackers simultaneously use several methods of overloading servers, increased from 8.0% in 2025 to 11.7%. The share of attacks such as UDP flood, TCP flood and SYN flood has increased significantly – all based on sending a huge number of fake network queries that prevent the server from serving real users. Separately, there is a sharp jump in ICMP flood attacks - from 0.1% to 4.3%.
At the same time, the largest of the observed botnets for the first time in two years sharply decreased: from 13.5 million devices in the first quarter to 2.09 million in the second. CURATOR attribute this to a joint operation of law enforcement agencies of the United States, Canada and Germany, during which the infrastructure of the Aisuru and Kimwolf botnets was disrupted. The United States now accounts for the largest share of the sources of attacks - 15.9%.
Despite the operation against two large ботнетовbotnets, CURATOR experts do not expect a long-term threat reduction: the number of vulnerable devices continues to grow, and the tools for organizing attacks based on artificial intelligence are becoming more accessible.
At the same time, the sources of attacks are distributed around the world more and more evenly, which reduces the benefits of blocking traffic on a geographical basis - experts consider this measure of protection to be less and less effective. As a more reliable approach, the report highlights the comprehensive protection of the resource, not tied to industry assumptions: the threat of sharp spikes in traffic is relevant for any public website or service, regardless of its scope of activity.
