Major Botnets Rebound as DDoS Attacks Surge
News related to:Qrator Labs · 2 min read
In the first quarter of 2026, the largest observed botnet reached a record 13.5 million devices, marking a significant increase from the previous quarter. This growth followed a joint operation by law enforcement agencies in the US, Canada, and Germany that disrupted infrastructure used by major botnets, including Aisiru and Kimwolf. However, by the third quarter, large botnets were already growing again, indicating that the takedowns had a temporary effect.
According to Qrator Labs, botnet operators are now experimenting with infrastructure that is harder to disrupt. Aeternum and Void, for example, use smart contracts on the Polygon and Ethereum blockchains as decentralized command and control (C2) channels, removing the single command server that can simply be seized or taken offline. This new approach makes botnets more resilient and harder to dismantle.
Another development is the use of artificial intelligence (AI) within botnets themselves. Qrator Research Labs recently identified x47.c, a Windows botnet that uses xAI's Grok to help maintain persistence on infected machines and includes an "AI API drain" mode designed to exhaust a victim's paid AI credits. This integration of AI technology is making botnets more sophisticated and harder to combat.
Meanwhile, DDoS activity has surged. In the first nine months of 2026, Qrator Labs mitigated 140.7% more DDoS attacks than during the same period in 2025. The number of attacks exceeding 1 terabit per second (Tbps) jumped from just one to 20. This increase in the scale and frequency of DDoS attacks is a concerning trend for businesses and organizations.
Attack infrastructure is also becoming more geographically distributed. The top five source countries for Layer 7 (L7) DDoS attacks accounted for 40.4% of blocked IP addresses in Q3, down from 41.9% in Q2. At the same time, the share of countries outside the top 20 rose from 29.8% in Q2 to 32.6% in Q3. This diversification of attack sources makes it more challenging to predict and defend against DDoS attacks.
The market for DDoS protection and mitigation is also expanding. The DDoS protection and mitigation market is projected to grow from $5.03 billion in 2024 to $5.76 billion in 2025, at a compound annual growth rate (CAGR) of 14.7%. The rise in frequency and complexity of DDoS attacks, cybersecurity concerns, reliance on internet-based services, financial loss prevention, and the global expansion of online services are driving this growth.
Qrator Labs, a recognized expert in cybersecurity and continuous network availability, provides reliable, low-latency DDoS mitigation and bot protection services for businesses across North and South America, Europe, the Middle East, and Asia. The company's geographically distributed filtering network includes 13 points of presence worldwide, with a total capacity of more than 6 terabits per second (Tbps).
The surge in DDoS activity and the evolving tactics of botnet operators highlight the ongoing challenges in cybersecurity. As the threat landscape continues to evolve, businesses must remain vigilant and invest in robust DDoS protection and mitigation strategies to safeguard their digital assets.