Cloudflare and Microsoft reported mitigating record-breaking distributed denial-of-service (DDoS) attacks in 2025, with traffic volumes exceeding 15 terabits per second (Tbps). Cloudflare blocked a 7.3 Tbps attack earlier in the year and later mitigated a 31.4 Tbps DDoS assault, which it documented in its Q4 2025 DDoS report. Separately, Microsoft said its Azure infrastructure absorbed a 15.72 Tbps attack in October 2025, which it attributed to the Aisuru botnet.

DDoS attacks aim to overwhelm websites, applications, networks, or servers by flooding them with traffic from numerous sources simultaneously. These attacks can target either network capacity or application-layer resources such as login pages and APIs, with the goal of rendering services unavailable, unstable, or costly to maintain.

The rise in large-scale attacks coincides with the proliferation of DDoS-as-a-service platforms on the dark web. These services lower the technical barrier for launching attacks by allowing users to pay for access to a web-based control panel, select a target, choose a duration, and leverage pre-built botnets or attack infrastructure owned by others. Such offerings are openly advertised across dark web forums and cybercrime communities.

Flare researchers analyzed DDoS-related underground activity during the first five months of 2023 and again during the same period in 2026. In 2023, underground posts frequently included scripts, leaked tools, tutorials, and generic “botnet service” advertisements. One advertisement promoted a “Botnet Service L7 - L4” claiming Layer 3, Layer 4, and Layer 7 capability, optional API access, automatic payments, high attack slots, game-server targeting, and Cloudflare bypass capabilities. Similar marketing language appeared across multiple vendors, suggesting widespread copying or reselling of promotional material.

By 2026, underground DDoS service advertisements had shifted toward emphasizing pricing structures and specific service features rather than general attack capabilities. Services such as “SatelliteStress” offered monthly plans starting at €20, advertised a user-friendly panel, API access, game-server support, and claimed to be “100% botnet-powered” without reliance on downstream APIs. Other offerings like “Areshun” and “RebirthStress” promoted premium features including Layer 4 and Layer 7 attack options, 24/7 support, reseller programs, and plans starting as low as $15 per month.