Netscout recently released its latest Threat Intelligence Report that documents DDoS attacks in the second half of 2024. As has been the trend for many years, the largest target of DDoS attacks has been ISP networks. There were over 8.9 million DDoS attacks documented in the second half of last year, up 12.75% over the first half of the year.

The report shows that the largest number of DDoS attacks came against wired ISPS and carriers. In the second half of 2024, there was 524,445 attacks against wired network, with the second most attaches against computer infrastructure providers at 197,221. This is not hard to understand since attacks against an ISP is the easiest way to make an attack against a specific target.

The report shows that the average DDoS attack against wired networks lasted for 33 minutes and that the maximum attack for the period used 937 Gbps during the attack.

Wireless carriers saw 24,433 attacks in the second half of 2024, with an average duration of 86 minutes and the maximum size of the attack measured at 119 Gbps.

Netscout noted that DDoS attacks are now outpacing other kinds of cyberthreats. DDoS attacks are launched by sending huge amounts of requests for connection to a specific network, often at critical times. The purpose is to effectively knock the network out of service for a while.

The report notes that a lot of the attacks are politically motivated. Attacks against Israel were up 2,844 percent last year, and attacks against Georgia were up 1,478 percent. The report notes that DDoS attacks are not just a cybercriminal tool but have become a dominant tool in geopolitical intimidation.

The report notes some of the regional causes for attacks. For example, in Kenya, a lot of attacks were launched to protest finance bills. In Mexico, the attacks spiked to coincide with elections.

The attacks are often launched by linking low-power Internet of Things (IoT) botnets with high-performance enterprise servers and routers, which amplifies the efficiency of the attack. Netscout notes that artificial intelligence automation is helping to prolong the attacks. Attackers are using a variety of methods including carpet-bombing, IPv6 abuse, ISP masking, and geo-spoofing. Unfortunately, many of the tools used to fight back and end DDoS attacks are losing effectiveness.