South Africa experienced 306,661 distributed denial-of-service (DDoS) attacks in the first half of 2026, marking a 78% rise from the 171,812 recorded in the second half of 2025. This surge exceeded the global growth rate, where attacks increased by 14% to reach 9.1 million worldwide over the same period. NETSCOUT’s DDoS Threat Intelligence Report, compiled using its ATLAS platform, provided these figures.
Wireless carriers face the greatest threat
South African wireless carriers absorbed the largest share of attacks, 235,746, or 77% of the total, with an average duration of 51 minutes. Other industries saw fewer incidents: computer services (23,433), insurance agencies (9,201), and hosting or data-processing providers (6,303). However, attacks on hosting providers lasted far longer, averaging 349 minutes, more than five hours.
The country’s average attack length decreased slightly to 68.3 minutes, down from over 74 minutes in late 2025. During that year, South Africa led globally in attacks against commercial banking and insurance sectors. The most severe attack in 2026 combined 25 different techniques, showing how DDoS tactics are becoming more sophisticated.
Regional threats reveal uneven risks
South Africa remained Africa’s top target, with 306,661 attacks, more than double Morocco’s 153,429, the continent’s second-highest. Mauritius (56,581) and Kenya (56,544) followed, while Nigeria (4,549) and Ghana (715) reported far fewer incidents. Attack durations varied sharply: Morocco’s average was 12.7 minutes, whereas Gabon’s exceeded 16 hours.
Mobile carriers remained the primary focus in Morocco and Mauritius, but in Kenya, wired telecommunications operators faced slightly more attacks than wireless providers. The wide range in attack lengths, from minutes in Morocco to hours in Gabon, indicates attackers are tailoring strategies to exploit regional infrastructure weaknesses.
Globally, attacks exceeding 1 terabit per second (Tbps) or 1 gigapacket per second (Gpps) rose by 1,286% year-over-year. NETSCOUT also documented its first IPv6 attack above 1Tbps, while efforts to block IPv6 attacks surged by over 300%. Direct-path attacks, which bypass conventional defenses, now account for 64.4% of all incidents, marking three consecutive increases. Meanwhile, “carpet bombing”, distributing traffic across multiple targets to avoid detection, grew from 3.97% to 4.54%.
Brief attacks lasting one minute or less also increased, rising from 1.6% to 3.1%, likely due to the rise of DDoS-for-hire services. Residential proxy networks, which route malicious traffic through home connections, are complicating efforts to distinguish harmful from legitimate activity.
