Of the 8 million attacks, 3.2 million were monitored in Europe, the Middle East and Africa (EMEA). Hacktivist groups like NoName057(16) orchestrated hundreds of coordinated strikes each month, targeting the communications, transportation, energy, and defence sectors. DDoS-for-hire services have democratised attack tools, enabling novice actors to execute sophisticated attack campaigns. AI-enhanced automation, multi-vector attacks, and carpet bombing techniques challenge traditional defences. Botnets compromised tens of thousands of IoT devices, servers, and routers, delivering sustained attacks and causing significant disruption.

While each of these elements is dangerous on its own, in aggregate, they have formed the perfect storm, creating unprecedented cyber risk for organisations and service provider networks around the world, Netscout said.

The company observed more than 50 attacks greater than a terabit-per-second (Tbps) and multiple gigapacket-per-second (Gpps) attacks in the first half of 2025, including a 3.12 Tbps attack in the Netherlands and a 1.5 Gpps attack in the United States.

The India-Pakistan conflict saw hacktivist groups target the Indian government and financial sectors in May, while the Iran-Israel conflict generated more than 15,000 attacks against Iran and 279 against Israel in June.

More than 880 bot-driven DDoS attacks occurred daily in March, peaking at 1,600 incidents, with attack durations increasing to an average of 18 minutes.

Leveraging DDoS-for-hire infrastructure, DieNet orchestrated over 60 attacks since March, while Keymous+ launched 73 attacks across 28 industry sectors in 23 countries.

NoName057(16) maintained dominance, claiming more than 475 attacks in March alone, 337% more than the next most active group. The hacktivist group targeted government websites in Spain, Taiwan, and Ukraine.

“As hacktivist groups leverage more automation, shared infrastructure, and evolving tactics, organizations must recognize that traditional defences are no longer sufficient,” stated Richard Hummel, director, threat intelligence, Netscout. “The integration of AI assistants and the use of large language models (LLMs), such as WormGPT and FraudGPT, escalates that concern. And, while the recent takedown of NoName057(16) was successful in temporarily reducing the group’s DDoS botnet activities, preventing a future return to the top DDoS hacktivist threat is not guaranteed. Organisations need intelligence-driven, proven DDoS defences that can deal with the sophisticated attacks we see today.”

The post DDoS attacks continue to dominate the digital battlefield, destabilising critical infrastructure appeared first on ProtectionWeb.

According to NETSCOUT, the DieNet group announced itself on 7 March 2025, via a now-banned Telegram channel, and its targets span transportation, energy, medical systems and digital commerce.

DieNet has leveraged DDoS-as-a-service infrastructure, commonly shared with other groups such as OverFlame and DenBots Proof, to launch ideologically driven attacks against the US, Iraq, Israel, Sweden, and Egypt to date. And, although the group claims some success, it is often difficult to validate whether the attacks have had any impact on the targets. 

“However, their scale and frequency – often allegedly averaging one attack per day – expose the ease with which new actors can exploit widely accessible rented infrastructure to launch their own DDoS campaigns,” says Bryan Hamman, regional director: Africa at NETSCOUT, “and this is something that should raise concern across Africa.” 

“Local organisations are increasingly being targeted by DDoS and other cyberattacks, particularly in sectors like telecoms, government and financial services. The rapid mobilisation and global scale of groups like DieNet highlight just how easily bad actors can take advantage of available tools to disrupt services on any continent, including ours.”

Since its emergence earlier this year, DieNet has gained visibility through other known active threat actor organisations, such as Mr. Hamza, Sylhet Gang-SG and LazaGrad Hack. Its attack methods are characterised by a mixture of vectors such as TCP RST, DNS amplification, TCP Syn and NTP amplification. The chosen vectors and attack patterns vary between targets.

Despite DieNet’s claims, NETSCOUT’s analysis reveals no evidence of a proprietary botnet. Instead, the group appears to rely on the same attack infrastructure used by other threat actors, reinforcing the risk posed by DDoS-as-a-service ecosystems.

The tactics used by DieNet demonstrate how easily malicious actors can launch attacks using widely accessible platforms, without needing large-scale technical infrastructure, comments Hamman.

“What’s clear is that organisations in Africa can no longer afford a reactive approach,” he adds. “Early detection, real-time visibility and proactive mitigation are critical to staying one step ahead of cyber criminals.”

The post NETSCOUT warns of new hacktivist threat posing global risks, from the US, Middle East, Africa and beyond appeared first on ProtectionWeb.

Highest number of attacks and vectors reported in South Africa

South Africa once again recorded the highest number of DDoS attacks in the region by a considerable margin with 130,931 events, although this has dropped significantly compared to the more than 230,000 incidents seen over the first half of 2024. 

The largest attack peaked at 210.65 Gbps and 20.38 Mpps, with a maximum of 23 attack vectors used in a single incident — the highest in southern Africa – led by TCP ACK, DNS Amplification and TCP SYN/ACK amplification. 

Top targeted industries included computer-related services businesses, insurance agencies and brokerages as well as computing infrastructure providers, reflecting South Africa’s digital maturity and central role in Africa’s online ecosystem. Interestingly, both wired and wireless telecommunications providers, portfolio management companies and commercial banking organisations also rated amongst the 10 most attacked sectors in South Africa.

Mauritius under siege, as DDoS attacks jump by 37 percent

Mauritius continues to be a key local hotspot, registering over 41,800 attacks, a marked increase over the 30,446 incidents in the first half of last year. The wireless telecommunications carriers sector alone accounted for nearly 40,000 incidents, making it one of the most targeted verticals across the region, followed to a lesser degree by wired telecommunications and full-service restaurants. 

Peak throughput reached 35 Mpps and peak bandwidth reached 224 Gbps, confirming the nation’s growing vulnerability due to its increasing digital infrastructure.

Namibia sees fewer attacks but remains regional hotspot

Despite a relatively small population size when compared to other southern African countries, Namibia reported 45,283 attacks, placing it among the top five in the region.  However, this was a noteworthy decrease after the 76,337 experienced in the former half of 2024.

The most used vector was DNS amplification (34,508 incidents), followed by TCP ACK and TCP SYN/ACK amplification. The largest recorded attack reached 30.11 Gbps and 2.88 Mpps. Notably, restaurants were flagged as the number one targeted sector, followed by computer services businesses and wireless telecommunications organisations.

More attacks, greater complexity: Angola’s growing DDoS challenge

With an increased 19,046 DDoS attacks over the 14,281 incidents in the first half of 2024, Angola faced up to 18 distinct vectors in a single event. The DNS amplification vector was dominant (4,753 attacks), with significant use of TCP ACK and TCP SYN as well. 

Wired telecommunications and computing infrastructure providers were the primary victims, with the largest attack hitting 85.94 Gbps and an average duration of 76.13 minutes.

Botswanan telecommunications in the crosshairs

Botswana recorded 981 attacks, which almost exclusively affected wireless telecommunications organisations, with a maximum bandwidth of 2.49 Gbps and average duration of 29 minutes. The dominant vector was TCP SYN/ACK amplification.

Eswatini suffers specific targeting

Eswatini saw 619 incidents over the last six months of 2024; up from 209 for the first half of the year and representing an increase of effectively 200 percent. A number of these attacks were specifically directed toward the real estate sector, suggesting focused rather than opportunistic activity. The average attack duration was shorter than for other southern African countries, at 7.3 minutes, with bandwidth below 1 Gbps.

High intensity strikes in Zimbabwe

Zimbabwe experienced 476 DDoS attacks over the period, with the largest recorded attack reaching a bandwidth of 1.07 Gbps and a throughput of 2.51 Mpps.

Where the country had previously recorded only 189 attacks over the first six months of 2024, telecommunications bore the brunt of high-impact attacks over the second part of the year, experiencing the maximum bandwidth and throughput. This was followed by supermarkets and grocery retailers, as well as one attack on a local sporting goods retail business, which was the longest specific DDoS duration in the country at 37 minutes.

Tech and telecoms under fire in Mozambique

Mozambican organisations were subjected to a total of 425 DDoS attacks, most commonly of the TCP ACK and TCP SYN/ACK amplification variety, a serious reduction in attack frequency after the 3,145 incidents over the first half of the year.

With a peak attack rate of 1.83 Gbps, computer-related services and satellite telecommunications were the two main verticals under attack noted in the 2h 2024 report.

DDoS attacks drop in Zambia

Zambia experienced the lowest number of DDoS events in the region, at 153, down from 428 from January to June 2024, with the largest attack measured at 9.63 Gbps and 0.95 Mpps. 

While relatively low in volume, the attacks were technically diverse, with up to eight vectors used in a single incident. Top vectors included TCP SYN/ACK, TCP ACK and DNS amplification, and almost all attacks were directed at the computer services field. 

Shared vectors and regional trends

“The NETSCOUT data revealed in the second Threat Intelligence Report for 2024 underlines a rapidly evolving DDoS threat landscape across southern Africa, with countries like South Africa, Mauritius and Angola facing high volumes of increasingly sophisticated attacks,” explains Bryan Hamman, regional director for Africa at NETSCOUT. 

“Across the board, TCP ACK, DNS amplification, TCP SYN/ACK amplification and ICMP remain the most used attack vectors within the region, and the practice of multivector attacks in many of the countries shows a shift toward more sophisticated, layered methods designed to bypass standard mitigation measures.

“And even while other countries, such as Zambia and Mozambique, reported fewer incidents, the technical diversity and targeted nature of the attacks reveal a concerning trend toward more calculated and industry-specific campaigns.

“As digital ecosystems across southern Africa expand, so too does the attack surface,” adds Hamman. “Organisations must remain vigilant, investing in proactive threat intelligence and robust, multi-layered cybersecurity strategies to stay ahead of threat actors targeting the region.”

The post Latest NETSCOUT Threat Intelligence Report Reveals Diverse DDoS Threats Across Southern Africa  appeared first on ProtectionWeb.

Bryan Hamman, regional director for Africa at NETSCOUT, explains: “We’re witnessing AI not just as a defence mechanism but also as a potential threat amplifier. The adoption of machine learning allows adversaries to automate reconnaissance and tailor attacks at extraordinary scale.”

In many African countries, digital adoption is outpacing cybersecurity measures, placing businesses, governments and individuals in a precarious position. According to Hamman, without the right proactive measures in place, local organisations risk falling victim to AI-powered threat scenarios, where malware can evade traditional defences, phishing attacks become hyper-personalised and response times shrink dangerously.

“AI can be a double-edged sword, and African businesses must ensure they leverage its benefits for better protection, while steering clear of the darker side of AI by staying a step ahead of attackers,” he advises.

Generative AI (GenAI) can take many facets of cyberthreats to new levels. These could include:

• Enhancements to social engineering, such as:
  • Crafting more convincing and unique phishing emails.
  • Mimicking voices in audio messages.

• Image or video generation:
  • Deepfake images have been shown to trick biometric facial recognition if executed correctly.

• Attack scale:
  • Scaling an attack to be bigger and better is easier than ever due to the automation AI can empower.
  • Automating rudimentary processes, such as sending phishing emails, can allow cyber criminals target more individuals within an organisation to increase their chances of gaining access.

Furthermore, the integration of AI into denial-of-service (DDoS) attacks is becoming a reality, allowing threat actors to optimise botnet behaviour and target selection, making these disruptions more destructive and difficult to mitigate.

NETSCOUT urges organisations to stay vigilant by investing in AI-driven security solutions and fostering a culture of cybersecurity awareness through consistent training. “The key lies in not just reacting to threats, but pre-empting them,” Hamman concludes. “As African markets grow, robust, AI-driven cybersecurity strategies will become increasingly crucial to ensuring that digital innovation is secure and sustainable.”

NETSCOUT’s Arbor DDoS protection assures the world’s largest networks and service providers against DDoS attacks of all shapes and sizes. For more information, click here. 

The post Is AI a game-changer for cyberthreats in Africa? appeared first on ProtectionWeb.