Less Attacks, More Strikes: How DDoS Threats Are Changing in 2026

Experts studied the statistics of DDoS attacks for the nine months of 2026 and the two previous years. They found that the total number of incidents is declining, but their power, speed and duration are growing markedly. At the same time, attackers are increasingly choosing small and medium-sized businesses as targets.

According to the DDoS protection service, the average number of attacks in the first nine months of the year decreased by 65% in annual terms. The rate fell the most in the public sector and among companies operating in the b2c market. More than twice in each segment. In the b2b segment, the number of attacks decreased by 47%, the press service of MegaFon reported.

At the same time, the characteristics of the attacks themselves increase. The maximum traffic capacity was 46% higher than in 2025. The speed of sending packages increased by 67%. Median indicators also increased, capacity - by 30%, packet speed - by 41%.

The duration of the incidents has also changed. If in 2024 the longest attack lasted nine days, and in 2025 – three days, in 2026 the record was seven days. In addition, for the second year in a row, Saturday remains the “working” day for attackers. It is on this day that the largest number of attacks occur. For comparison, in 2024, peak activity fell on Monday.

Natalia Glinina, Head of Cybersecurity Products Development at MegaFon, explained that the trend of transition from quantity to quality remains. Criminals rely not on scale, but on sophistication. They actively combine different parameters – mixing traffic types, changing levels and temporal profiles of attacks to bypass defense mechanisms. Artificial intelligence plays an important role in this. It automates the search for vulnerabilities, adapts malicious code to the reactions of security systems and forms complex traffic patterns. This is what makes attacks more powerful.

According to the Cybersecurity Index, DDoS attacks are the most common threat. They account for 42% of all incidents. Among the companies that faced such attacks, 42% suffered losses of up to a million rubles, the remaining 58% – more than a million.

Small and medium-sized businesses are becoming an increasingly attractive target. The level of protection in this segment is usually lower than that of large corporations. The danger lies in the shutdown of services and related threats. For example, in the introduction of malware to encrypt data. Therefore, protection from such risks should be the basic minimum for any entrepreneur, the experts recalled.