Large DDoS botnets rebound as attacks surge, Qrator says

Large DDoS botnets grew again in the third quarter after a sharp decline in the previous three months, Qrator Labs said. The cyber security company also reported a steep rise in the number of DDoS attacks it mitigated.

The largest botnet observed during mitigation of layer 7 DDoS attacks reached 3.56 million devices in the quarter, up about 70% from 2.09 million in the prior three months. That followed a much steeper fall from a record 13.5 million devices in the first quarter.

The earlier drop came after a joint law enforcement operation in the US, Canada and Germany disrupted infrastructure linked to major botnets including Aisuru and Kimwolf. By the third quarter, however, the data suggested large botnets were being rebuilt.

Attack trends

DDoS activity rose sharply over the first nine months of the year, with Qrator Labs mitigating 140.7% more attacks than in the same period a year earlier.

The number of attacks exceeding 1 Tbps rose from one to 20. The most intensive attack recorded in the third quarter reached 1.38 Tbps and hit the telecom sector, while a 1.36 Tbps attack targeted game servers.

The longest incident in the quarter targeted a bank and lasted 200 hours, or more than eight days. That compares with a peak of 79.9 hours in the second quarter and 119.2 hours across the whole of 2025.

The mix of attack methods also changed. UDP floods became the most common attack vector, accounting for 50.2% of attacks and overtaking HTTP at 39.8%. Together, the two made up 90% of all DDoS attacks observed in the quarter.

Target sectors

Financial services remained the main target, accounting for 31.3% of DDoS incidents in the third quarter. E-commerce followed with 19.0% and ICT with 18.2%.

Within those sectors, trading services made up 12% of attacks, software companies 11.8%, banks 8.3%, betting services 7.6% and online retail 6%.

The infrastructure behind attacks also became more geographically dispersed. The top five source countries for layer 7 DDoS attacks accounted for 40.4% of blocked IP addresses in the third quarter, down from 41.9% in the second quarter.

At the same time, the share of countries outside the top 20 rose to 32.6% from 29.8%, pointing to a broader distribution of attack sources rather than concentration in fewer locations.

Botnet changes

Botnet operators were testing infrastructure that is harder to disrupt through conventional takedowns. Qrator Labs cited Aeternum and Void as examples of botnets using smart contracts on the Polygon and Ethereum blockchains as decentralised command-and-control channels.

That structure removes the single command server investigators can seize or disable. The report also pointed to the use of artificial intelligence within botnets.

Qrator Research Labs recently identified x47.c, a Windows botnet that uses xAI's Grok to help maintain persistence on infected machines. It also includes what Qrator Labs described as an "AI API drain" mode aimed at exhausting a target's paid AI credits.

Automated abuse

Beyond DDoS attacks, malicious automated traffic remained a major issue at the application layer. Qrator Labs observed an average of 1.8 billion malicious bot requests a month in the third quarter.

E-commerce accounted for 55.6% of all bad bot requests, making it the most targeted industry by a wide margin. The longest bad bot attack against an eCommerce service lasted almost 6.5 days and generated about 60 million malicious requests.

The figures underline the pressure online retailers face not only from high-volume denial-of-service attacks but also from sustained automated abuse designed to scrape data, disrupt operations or overload web services.

"Takedowns can seriously disrupt even the largest botnets, but their effect is temporary. They remove existing infrastructure, but not the conditions that allow botnets to grow in the first place: millions of vulnerable devices worldwide and increasingly automated ways to find and compromise them. As long as those conditions remain, botnets will be rebuilt - and we are already seeing that happen," said Andrey Leskin, Chief Technology Officer at Qrator Labs.

"Now attackers are experimenting with blockchain-based C2 infrastructure and using AI to maintain persistence on infected machines, making botnets more resilient and harder to disrupt," Leskin said.