Link11 Reports 225% more DDoS attacks in H1 2025 with new tactics against infrastructure

The threat landscape for distributed denial-of-service (DDoS) attacks intensified in the first half of 2025, with attacks targeting the Link11 network rising by 225% compared with the same period in 2024, according to Link11 European Cyber Report. The volume of traffic reached 438 terabytes, equating to more than seven years of non-stop 4K Netflix streaming, and peak values hit 1.2 terabits per second and 207 million packets per second.

Notably, there has been a shift from short flash attacks to coordinated long-term campaigns, with the longest documented attack lasting more than eight days. While volumetric attacks remain common, there is a marked rise in precise Layer 7 attacks that disguise themselves as legitimate data traffic, described by Jag Bains, VP Solution Engineering at Link11.

Politically motivated campaigns were identified, including groups such as NoName057(16) targeting government agencies, banks, energy suppliers and city administrations in Europe, with other groups like Dark Storm and Keymous becoming more prominent, according to the report. The findings underline the need for real-time monitoring, AI-supported defence, and resilience planning to mitigate increasingly sophisticated and sustained DDoS threats.