Link11: Fewer attacks, more force: Link11’s European Cyber Report finds new DDoS records for the first half of 2026

Super-Botnets and Hijacked Cloud Servers Fuel Record-Breaking DDoS Attacks in Europe

Frankfurt, Germany – September 3, 2026 – Link11’s latest European Cyber Report for the first half of 2026 reveals a stark shift in DDoS attack trends: while the total number of attacks dropped by 42%, their intensity reached unprecedented levels, driven by super-botnets and compromised cloud infrastructure.

New Highs in Attack Power
Despite the decline in attack frequency, the first half of 2026 saw record-breaking metrics across all major categories:

• Bandwidth: Peaked at 2.3 Tbit/s, an 85% increase from the previous high of 1.2 Tbit/s in early 2025.
• Packet rate: Reached 322 million packets per second, up 56% from 207 million in 2025.
• Cumulative traffic: Surged to 705 terabytes, a 61% rise from 438 terabytes over the same period.

Super-Botnets and Cloud Exploitation Behind the Surge
The report attributes these records to advanced botnets like Aisuru and its successor, Kimwolf, alongside a growing reliance on hijacked cloud servers, which deliver far greater bandwidth than traditional compromised IoT devices. The reduction in attack volume is credited to international law enforcement efforts, including:

• The July 2025 takedown of pro-Russian group NoName057(16)’s infrastructure during Operation Eastwood.
• A March 2026 joint operation by U.S., Canadian, and German authorities dismantling four major IoT botnets, collectively controlling over three million devices.

Repeat Targeting and Stealth Tactics
The report highlights a worrying trend: only 44% of targeted organizations avoided follow-up attacks within 30 days, down from 54% in 2025. Additionally, attackers are increasingly using DDoS "noise" as cover for more damaging exploits. In one documented case, a traffic spike masked SQL injection and XSS probes, only detected due to reused IP addresses.

A Shift in Threat Landscape
Link11’s CEO, Jens-Philipp Jung, emphasized that defenses based on past attack volumes are inadequate, as a single incident can now escalate far more rapidly. VP of Solution Engineering Jag Bains warned that the most dangerous attacks are no longer the loudest, often designed to evade traditional detection methods.

The full report details how force and concealment, rather than sheer attack numbers, now define the DDoS threat landscape in 2026.

Source: https://cybersecuritynews.com/fewer-attacks-more-force-link11s-european-cyber-report-finds-new-ddos-records-for-the-first-half-of-2026/

Link11 GmbH cybersecurity rating report: https://www.rankiteo.com/company/link11

"id": "LIN1788454856",
"linkid": "link11",
"type": "Cyber Attack",
"date": "1/2026",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"

{'affected_entities': [{'location': 'Europe',
                        'type': 'Organizations (unspecified)'}],
 'attack_vector': ['Botnets', 'Hijacked Cloud Servers'],
 'date_detected': '2026-01-01',
 'date_publicly_disclosed': '2026-09-03',
 'description': 'Link11’s latest European Cyber Report for the first half of '
                '2026 reveals a stark shift in DDoS attack trends: while the '
                'total number of attacks dropped by 42%, their intensity '
                'reached unprecedented levels, driven by super-botnets and '
                'compromised cloud infrastructure. Record-breaking metrics '
                'include a peak bandwidth of 2.3 Tbit/s, a packet rate of 322 '
                'million packets per second, and cumulative traffic of 705 '
                'terabytes. The surge is attributed to advanced botnets like '
                'Aisuru and Kimwolf, alongside hijacked cloud servers. Law '
                'enforcement efforts have reduced attack volume, but repeat '
                "targeting and stealth tactics (e.g., DDoS 'noise' masking SQL "
                'injection and XSS probes) pose new challenges.',
 'impact': {'operational_impact': 'Disruption of services due to unprecedented '
                                  'DDoS intensity'},
 'lessons_learned': 'Defenses based on past attack volumes are inadequate; '
                    'single incidents can escalate rapidly. The most dangerous '
                    'attacks are often designed to evade traditional detection '
                    "methods (e.g., DDoS 'noise' masking other exploits).",
 'motivation': ['Disruption',
                'Cover for other exploits (e.g., SQL injection, XSS)'],
 'post_incident_analysis': {'root_causes': ['Advanced botnets (Aisuru, '
                                            'Kimwolf)',
                                            'Hijacked cloud servers',
                                            'Reduced law enforcement '
                                            'deterrence post-takedowns']},
 'references': [{'date_accessed': '2026-09-03',
                 'source': 'Link11 European Cyber Report H1 2026'}],
 'response': {'law_enforcement_notified': 'International law enforcement '
                                          'efforts (e.g., Operation Eastwood, '
                                          'joint U.S./Canadian/German '
                                          'operations)'},
 'threat_actor': ['NoName057(16)', 'Aisuru', 'Kimwolf'],
 'title': 'Super-Botnets and Hijacked Cloud Servers Fuel Record-Breaking DDoS '
          'Attacks in Europe',
 'type': 'DDoS'}