Gcore Radar Report Snapshot H1 2026: DDoS Attack Trends

Instead of our usual biannual Radar Report, which tracks global DDoS attack trends, this time we’re sharing a handful of the most notable stats from the first half of 2026 here. This snapshot combines selected observations from Gcore’s DDoS attack data with lessons from incidents investigated in this period.

One pattern came up again and again: the size of an attack doesn’t tell you how much damage it can do. In H1 2026, we saw three different ways attackers put systems under strain. Some sent a huge wave of traffic all at once — multi-terabit floods, measured by sheer bandwidth. Some spread traffic thinly across many targets at once, so no single one looked alarming on its own. And some barely used much data at all — instead, they fired off an overwhelming number of individual requests per second (what’s known as a high packet rate), simply asking for too much, too fast, even with modest bandwidth.

This matters because defenses built to catch large traffic surges can miss attacks that don’t produce a spike at all. A target can appear unaffected while the shared infrastructure behind it bears the real strain. Recognizing an attack like this means monitoring bandwidth, packet rate, and total traffic across an entire group of targets, not any one of them alone.

Read on to learn more about industries most affected by cyberattacks, as well as changes in the duration and scale of attacks, and more. Here are five findings that stand out.

1. Attacks were down from the H2 2025 peak, but still above a year ago

In the first half of 2026, we recorded 1,246,080 attacks — 589,520 in Q1 and 656,560 in Q2 — an 11% rise over the two quarters.

Compared with last year, the trend continues: H1 2025 saw roughly 1.17 million attacks, which means this year’s total for the same period is about 6% higher.

Compared with the second half of last year, it’s a different story. Q3 and Q4 2025 combined for roughly 2.25 million attacks — nearly double this year’s H1 total — making H2 2025 look less like a new normal and more like a sharp, temporary spike.

2. Peak attack size stayed in the double-digit terabits

As we reported previously, Q4 2025 saw a peak of 12 Tbps, up from 2.2 Tbps in the first half of that year. On February 24, total traffic from a distributed attack across our network reached around 16 Tbps, and another on March 6 reached 12.8 Tbps. Large botnets and cheap amplification continue to keep multi-terabit attacks within reach.

3. Attacks got even shorter

The vast majority of attacks (83%) lasted less than a minute, up from 75% in H2 2025. Around 16% lasted one to ten minutes, down from 23% previously, and 1% lasted longer than ten minutes, down from 2% before. These are short, intense bursts meant to overwhelm a target before mitigation fully engages, so protection that depends on someone reacting will usually be too slow.

4. Spreading an attack across a subnet gets around per-IP limits

In H1 2026, we observed a significant increase in carpet-bombing DDoS attacks, which spread traffic across multiple IP addresses rather than concentrating it on a single target. On February 26, one such attack exceeded 8 Tbps and targeted a /24 IP address range. These attacks highlight the importance of detecting threats across an entire subnet, as the combined traffic can place substantial pressure on shared network capacity.

5. Hosting, cloud, internet service providers, and gaming felt the most pressure

The cases with real customer impact came mostly from hosting, cloud, internet service providers, and gaming. The hosting and cloud cases fit the pattern seen in H2 2025, when technology providers accounted for the largest share of attacks (34%). In May, a high-packet-rate attack with comparatively low bandwidth targeted a gaming service in Singapore, highlighting why DDoS protection must account for packet rates as well as traffic volume.

What these findings mean for DDoS defense

In essence, we saw fewer attacks than the H2 2025 peak, but more than a year ago. Most of them are over in under a minute. The biggest ones are still measured in terabits, and some span entire subnets. This means that defenses built to watch for scale alone will keep missing attacks that don’t look big on paper — what matters as much as size is how fast an attack moves, how its traffic is spread, and whether the damage lands on the actual target or on the infrastructure a target happens to share with others.

How Gcore can help you protect your infrastructure

Gcore DDoS Protection filters attack traffic at the network edge, with filtering capacity above 200 Tbps and 210+ points of presence across six continents. Gcore WAAP adds a web application firewall, bot management, and API security to cover application-layer attacks as well. Get in touch to find out how we can help protect your infrastructure.

Get in touch