Gcore Radar Q3–Q4 2025: three insights into an accelerating threat landscape

Cyberattacks are not just growing—they're accelerating at an alarming pace. The second half of 2025 marked a dramatic escalation in both the frequency and scale of DDoS attacks, with record-breaking volumes and increasingly sophisticated tactics that challenge traditional defense strategies. For businesses across industries, understanding these shifts is essential to building resilient, adaptive security.

The latest edition of the Gcore Radar report, covering Q3–Q4 2025, reveals unprecedented changes in attack volumes, geographic patterns, and attacker strategies. Together, these findings highlight a fundamental shift in the threat landscape and underscore why proactive, layered defense has never been more critical.

Here are three key insights from the report, which you can download in full here.

1. Attack volumes and scale have reached unprecedented levels

In Q3–Q4 2025, the total number of DDoS attacks more than doubled compared to the first half of the year, representing a sharp acceleration in threat activity.

Even more striking, the maximum observed attack size surged to 12 Tbps in Q4 2025—a sixfold increase from the 2.2 Tbps peak recorded in the first half of the year. This dramatic escalation reflects the growing availability of large botnets and more efficient amplification techniques, enabling attackers to generate extreme traffic volumes with unprecedented impact.

2. Geographic patterns reveal a dramatic realignment

The distribution of attack sources has shifted significantly. Network-layer attacks are now heavily concentrated in the Americas, with Mexico, Brazil, and the United States together accounting for 75% of all observed traffic.

This concentration is largely driven by the AISURU botnet's exploitation of compromised IoT device ecosystems across these regions. In contrast, application-layer attacks maintain a more globally distributed footprint, with notable activity from the United States, France, and other European nations.

3. Attackers deploy contrasting strategies across network and application layers

Attack tactics have become more nuanced and harder to defend against. At the network layer, 75% of attacks now last less than one minute—hyper-concentrated bursts designed to overwhelm defenses before automated mitigation fully engages.

Meanwhile, application-layer attacks are trending in the opposite direction. Half of all application-layer attacks now last between 10 and 30 minutes, with 8% exceeding an hour. These sustained campaigns target backend resources and business logic, blending into legitimate traffic to evade traditional defenses.

How Gcore helps businesses stay protected

As attack methods evolve and intensify, businesses need equally advanced protection. Gcore DDoS Protection offers over 200 Tbps filtering capacity across 210+ points of presence worldwide, neutralizing threats in real time regardless of scale. Integrated Web Application and API Protection (WAAP) extends defense beyond network perimeters, protecting against sophisticated application-layer attacks and business-logic exploitation.

To explore the report's full findings, download the complete Gcore Radar report here.

Download Gcore Radar Q3-Q4 2025