Shorter, bigger DDoS attacks: planning for the first minute

NETSCOUT recorded more than 9.1 million DDoS attacks across 209 countries and territories in the first half of 2026. Its 1H 2026 threat intelligence release, published on 14 October 2026, reports a 1,286% year-over-year increase in attacks exceeding 1 Tbps or 1 Gpps. The same research found that attacks lasting one minute or less have roughly doubled as a share of all attacks since the second half of 2023.

Taken together, those two findings change what a DDoS response plan has to do. This piece covers what NETSCOUT reported, why short attacks put more of the outcome on configuration than on people, and what security and infrastructure teams in the Gulf and Southeast Asia can test and ask their providers.

What NETSCOUT reported for 1H 2026

The headline figures from the release:

• More than 9.1 million DDoS attacks globally, January–June 2026, across 209 countries and territories.
• A 1,286% year-over-year increase in attacks above 1 Tbps or 1 Gpps.
• Active mitigation of IPv6 attacks up more than 300% year over year.
• Direct-path attacks at 64% of observed attacks.
• Carpet-bombing up from 3.97% to 4.54% of attacks.
• Attacks of one minute or less roughly doubled as a share since 2H 2023.

Hardik Modi, VP Engineering for DDoS Solutions and ASERT at NETSCOUT, said: "The 1,286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine." He added that "Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges".

Why a one-minute attack is a configuration problem

A typical DDoS runbook has human steps in it. An alert reaches the SOC, an analyst confirms it, someone contacts the mitigation provider, and traffic is diverted to scrubbing or a stricter policy is switched on. Every one of those steps takes time, and the total is usually measured in minutes.

An attack that lasts sixty seconds can be over before the first person has finished reading the alert. In that window, the only things working for you are the ones configured in advance:

• Detection thresholds that trip without anyone touching them.
• Mitigation that starts automatically once detection fires.
• Applications that keep serving users while traffic is being rerouted or filtered.

The third point gets the least attention. Moving traffic between paths, or switching on a stricter filtering profile, can disturb live connections. Sessions can drop, TLS handshakes can fail, and rate limits on an API gateway can start rejecting legitimate requests. For a bank, a minute of failed logins or payment errors is enough for customers to notice. On instant payment rails such as Aani (UAE), sarie (Saudi Arabia) and DuitNow (Malaysia), customers expect a transfer to complete in seconds, so a failure shows up immediately.

Carpet-bombing and per-IP detection

Carpet-bombing grew from 3.97% to 4.54% of attacks in NETSCOUT's data. Instead of sending all traffic to one address, a carpet-bombing attack spreads it across many addresses in a range. Each individual address may see a level of traffic that looks ordinary. If detection is tuned mainly to per-IP thresholds, it may not trip, even while the range as a whole, and the links serving it, come under strain.

Teams can ask their provider directly how detection handles traffic spread across a prefix, and whether thresholds are set per address, per range or both.

IPv6 and direct-path traffic

NETSCOUT reported that active mitigation of IPv6 attacks rose more than 300% year over year, and that direct-path attacks made up 64% of observed attacks. If your organisation has expanded IPv6 reachability, a sensible check is whether IPv6 mitigation policies, thresholds and monitoring have kept pace with IPv4, or whether they were set up once and left.

Questions to ask your DDoS mitigation provider

These are practical questions any bank, telco or government operator can put to a carrier or scrubbing provider:

1. Does mitigation trigger automatically, or does it need human approval?
2. What is the measured time from detection to active mitigation, and on whose traffic was it measured?
3. Who can change mitigation modes, on both sides, and how are they reached out of hours?
4. How does detection handle carpet-bombing across our address ranges?
5. Are IPv6 thresholds and policies configured to the same standard as IPv4?
6. What happens to established sessions and new connections during a switch to scrubbing or a stricter policy?

The answers to the first five sit mostly with the provider. The sixth depends on your own applications, and the only reliable way to answer it is to test.

What to test

A useful test of short-attack readiness looks at timing and application behaviour together:

• Run short, high-intensity bursts and record how long automatic detection and mitigation take to engage.
• Watch the customer-facing endpoints during that period: login, payments, account APIs, and any public web services.
• Note which ones degrade, which recover on their own, and which need a restart or manual action.
• Repeat after changes to provider configuration, network architecture or major application releases.

Where our testing fits

Volumetric reflection and amplification attacks are outside our simulation scope. Those belong with carriers and scrubbing providers, who are equipped to test them. Obsidio runs controlled, authorised simulations from a distributed network of real devices against the application layer and connection-level behaviour, with domain ownership verified, gradual ramp-up and live abort. That covers the part of the first minute that sits with your own systems.

What this means for the Gulf and Southeast Asia

Every digital service a bank, telco or public-sector operator in the GCC, Malaysia or Indonesia puts online is another endpoint that has to hold during an attack too short for anyone to respond to live. The figures above are global, and the direction is clear enough to plan for: bigger attacks, shorter attacks, and more of the outcome decided before anyone is paged.

To see how your applications behave during a short, sharp attack, get in touch at https://obsidio.me/contact