The new DDoS threat landscape

Terabit-scale attacks are now routine. Nokia’s Threat Intelligence Report 2025 found daily DDoS peaks of 5–10 Tbps, and a 33 Tbps attack against a gaming provider was observed in October 2025 — with terabit-scale attacks occurring roughly five times more often than a year earlier. At the same time, sheer size is only half the story: 82% of DDoS floods stay below 50 Gbps, relying on speed, repetition and precision rather than raw volume.

Most are over before a human can respond: in 2025, 78% of DDoS attacks ended within five minutes (up from 44% in 2024), and 37% lasted less than two minutes, with attacks often reaching peak intensity in one to three minutes. Campaigns may also recur in bursts over hours or days. Short does not mean harmless — fast, repeated hits interrupt payments, logins and communications, and they defeat any defense that needs minutes to divert traffic.

Botnets weaponize the enormous base of insecure IoT devices — IP cameras, DVRs, home and business gateways — now connected over gigabit and multi-gigabit broadband. Devices attack using real IP addresses, from inside and outside service provider networks, and once enrolled, they typically remain in the botnet permanently, ready to be triggered without warning. The largest botnet families have spanned hundreds of thousands to millions of devices, and their traffic can resemble normal consumer activity — defeating threshold- and reputation-based defenses.

Residential proxies route attack traffic through ordinary household connections, using constantly rotating consumer IP addresses, making malicious requests appear to be from genuine subscribers and defeating IP blocklists, geo-blocking, and rate limiting. Nokia identified more than 100 million residential endpoints as potentially exploitable and observed active residential-proxy endpoints associated with DDoS grow from about 1 million to 8–9 million in one year — with the United States accounting for 75% of both attack volume and compromised endpoints in 2025. Symmetric fiber uplinks and industrial-scale AI web scraping keep the proxy economy growing.

Attackers use automation and AI to orchestrate campaigns that shape-shift within seconds — rotating vectors from TCP carpet bombing to UDP floods to DNS attacks — while monitoring defenders’ thresholds, alert cadence and tactics and adapting in real time. In one observed 2025 campaign, four distinct attacks were launched within three minutes, each adjusted in response to the defensive response. Evidence of fully autonomous AI-driven attacks remains limited, but algorithmic orchestration is already the norm in sophisticated campaigns.

A DDoS tsunami is a hyper-volumetric flood — a massive wave of attack traffic, now reaching multiple terabits per second, that aims to overwhelm links and infrastructure through sheer scale. Nokia contrasts tsunamis with “piranha” attacks: swarms of small, short, precise strikes that stay under volumetric radar. Defending against both requires two kinds of intelligence — network-scale visibility for the tsunamis and behavioral, context-aware detection for the piranhas.

Carpet bombing spreads attack traffic across many addresses or prefixes — sometimes an operator’s entire address block — rather than concentrating on a single host, keeping per-destination volumes below detection thresholds while the aggregate load still saturates the infrastructure. It is one facet of the broader multi-target trend: in 2025, 52% of DDoS attacks targeted multiple systems simultaneously.

Inbound DDoS is malicious DDoS traffic arriving from outside a network toward targets inside it — the classic case. Outbound DDoS attacks originate from compromised devices within the network, targeting other customers within the network or external targets. When it goes outside the network, it consumes the operator’s own upstream capacity, degrades service for legitimate subscribers, damages the network’s IP reputation, and can create regulatory and legal exposure. Because botnet and residential-proxy endpoints live inside subscriber networks, modern operators must detect and mitigate in both directions.