DDoS-Guard Reports Record 540,000 L7 Attacks in June 2026 Amid Botnet Fragmentation
DDoS-Guard has published its Q2 2026 threat report, documenting an absolute record in the number of DDoS attacks and several notable shifts in attacker tactics.
Globally, the volume of terabit-class attacks doubled compared with the entire previous year. The two largest incidents reached 1.64 Tbps and 1.58 Tbps, generating 553 Mpps and 638 Mpps respectively. The largest overseas botnet observed contained approximately 2.09 million devices.
In March, authorities in the United States, Canada and Germany dismantled the infrastructure of four major IoT botnets: Aisuru, KimWolf, JackSkid and Mossad. Despite these takedowns, DDoS-Guard observed prolonged, highly distributed attacks throughout the quarter, indicating that attackers are compensating for smaller botnets by improving node efficiency and leveraging cloud resources.
Multiple vendors reported a rise in multi-vector campaigns that combine volumetric, protocol-exhaustion and application-layer techniques. At the same time, low-and-slow attacks designed to evade traditional filtering remain prevalent.
In April, Europol coordinated Operation PowerOFF across 21 countries, resulting in more than 75,000 warnings sent to users of DDoS-for-hire services, four arrests, infrastructure seizures and the closure of 53 domains.
On DDoS-Guard’s own network, L7 attacks increased 70% quarter-over-quarter, with the daily average nearly doubling. Median requests per second rose 270% to 75. The number of attacks lasting more than 24 hours grew by 380%. June set a new single-month record with 540,000 L7 attacks—236% more than April and 300% more than June 2025.
Attackers showed particular interest in job-search and HR platforms (+40%) as well as news outlets (+30%). Experts link the surge to the rapid expansion of public web services and APIs in Russia combined with the increasing use of browser automation and AI agents that make HTTP attacks harder to distinguish from legitimate traffic.
Related articles
Spyware-Laden Modified iOS Apps Distributed via Russian Telegram Channel, Kaspersky Discovers
Kaspersky researchers have identified modified versions of popular iOS applications that are being distributed through a Russian-language Telegram channel and contain a malicious spying module. The infected apps include a marketplace platform for selling goods, a photo editor, and a video viewing service, all offered as ad-free versions with extra free features. Attackers embed the spyware directly into legitimate IPA files, while some clean apps simply promote the same channel to funnel users toward the malicious downloads. Installation requires users to obtain a developer certificate and sign the app using tools such as eSign or Scarlet, or to sideload via a computer or jailbroken device, completely bypassing the App Store. Once launched, the malware collects device name, battery level, regional settings, memory information, jailbreak status, geolocation, carrier code, and screenshots before sending the data to the attackers, although it stops when the app is closed. Kaspersky advises users to obtain applications only from official stores or verified developer websites rather than random Telegram sources.
DarkSword Exploit Kit Expands to 180 Sites Targeting iPhone Users with Zero-Click Chain
The DarkSword exploit kit has scaled its infrastructure to 180 web properties hosted on 27 servers, enabling zero-click compromise of iPhones running vulnerable iOS versions. Attackers deploy fake pages impersonating Apple, AWS, and other popular services to trigger a six-vulnerability exploit chain that achieves remote code execution, sandbox escape, and privilege escalation on iOS 18.4 through 18.7. Once the device is compromised, GHOSTBLADE components extract data from the Keychain, iCloud files, Wi-Fi passwords, and other stored content before exfiltrating it to attacker-controlled panels. The malware deletes crash reports and forensic logs to hinder analysis and does not establish traditional persistence, limiting the window of data theft to a single visit. Infrastructure rotates rapidly, with five of seven administrative panels observed on July 30, 2026, having appeared only a week earlier, indicating frequent domain and host replacement to evade blocking.
Octagon Android RAT Poses as Bahrain Emergency Alert App to Steal Credentials and Establish Persistent Surveillance
A remote access trojan named Octagon targets Android devices by masquerading as the official emergency alerts application from Bahrain. The infection begins when victims download the BH-Alert.apk file from phishing websites. The malware guides users through seven steps to grant dangerous permissions while using encrypted code hidden inside a font file extension to evade static analysis. It installs a secondary component called OctagonPanel and deploys mutual-monitoring surveillance services that restart each other if terminated. Additional persistence is achieved through boot receivers, a fake Android account, and scheduled synchronization tasks every 30 minutes. The trojan abuses the Accessibility Service to record unlock patterns, PINs, and passwords while also harvesting SMS messages, contacts, call logs, and screenshots. A criminal-controlled VPN allows interception and redirection of victim traffic.
Distributed Crawler Poses as Human Visitor to Evade Analytics and Ad Filters
A detailed investigation revealed a sophisticated distributed crawler that successfully mimicked legitimate human browsing behavior across multiple unrelated websites. The crawler generated realistic events in Google Analytics while avoiding ad script loading and resource chains that would confirm genuine user sessions. Server logs showed consistent patterns of fake search engine referrers, internal navigation with fabricated Referer headers, and selective requests limited mostly to images returning 404 errors. Analysts built a graph-based detection system that correlated events across sites to expose the coordinated activity despite individual requests appearing benign. The campaign rotated browser signatures and IP addresses frequently, making single-site rate limiting ineffective. The case demonstrates how modern crawlers can exploit Measurement Protocol and incomplete bot detection to consume server resources without contributing to revenue.