Brazil Logs 487,000 DDoS Attacks in H1 2026 as Terabit-Scale Incidents Surge 1,286%, NETSCOUT Reports
A NETSCOUT report shows Brazil suffered 487,415 DDoS attacks between January and June 2026, a 3.56% increase over the previous semester's 470,677 incidents. Globally, NETSCOUT recorded over 9.1 million DDoS attacks in the same period, with high-capacity attacks exceeding 1 Tbps or 1 Gpps surging 1,286%. Wireless telecom providers were the top target in Brazil with 141,400 attacks, followed by hosting/computing infrastructure (50,499) and wireline telecom (27,967); banks, restaurants, logistics and retail firms also appeared among the top ten targeted sectors. The average attack duration in Brazil was 59.31 minutes, and TCP ACK was the most common method (138,626 occurrences), followed by DNS Amplification (61,575).
Detalhes técnicos
NETSCOUT identified 24 distinct attack method combinations in Brazil, including TCP SYN (37,481), DNS (20,736), and TCP SYN/ACK Amplification (18,044). The report highlights the growing use of residential proxies to mask attack traffic as legitimate home-user connections, and the rise of short-duration attacks offered through DDoS-for-hire platforms, both of which complicate detection and mitigation.
Remediação
Hardik Modi, VP of DDoS Solutions Engineering at NETSCOUT, states that high-capacity attacks are no longer anomalies but routine occurrences. He recommends that ISPs and organizations adopt more precise traffic identification and blocking mechanisms that avoid impacting legitimate connections, and increase filtering capacity at network edges.
Linha do tempo
-
Brazil Logs 487,000 DDoS Attacks in H1 2026 as Terabit-Scale Incidents Surge 1,286%, NETSCOUT Reports
ler a análise desta fonte ocultar
A NETSCOUT report shows Brazil suffered 487,415 DDoS attacks between January and June 2026, a 3.56% increase over the previous semester's 470,677 incidents. Globally, NETSCOUT recorded over 9.1 million DDoS attacks in the same period, with high-capacity attacks exceeding 1 Tbps or 1 Gpps surging 1,286%. Wireless telecom providers were the top target in Brazil with 141,400 attacks, followed by hosting/computing infrastructure (50,499) and wireline telecom (27,967); banks, restaurants, logistics and retail firms also appeared among the top ten targeted sectors. The average attack duration in Brazil was 59.31 minutes, and TCP ACK was the most common method (138,626 occurrences), followed by DNS Amplification (61,575).
Technical Details
NETSCOUT identified 24 distinct attack method combinations in Brazil, including TCP SYN (37,481), DNS (20,736), and TCP SYN/ACK Amplification (18,044). The report highlights the growing use of residential proxies to mask attack traffic as legitimate home-user connections, and the rise of short-duration attacks offered through DDoS-for-hire platforms, both of which complicate detection and mitigation.
Remediation
Hardik Modi, VP of DDoS Solutions Engineering at NETSCOUT, states that high-capacity attacks are no longer anomalies but routine occurrences. He recommends that ISPs and organizations adopt more precise traffic identification and blocking mechanisms that avoid impacting legitimate connections, and increase filtering capacity at network edges.