The second quarter of 2025 saw a massive rise in application layer DDoS attacks, new research shows, with financial services firms the biggest target.
Application-layer attacks target web applications and are hard to detect, with malicious traffic closely resembling legitimate user requests. According to researchers at Qrator Labs, the second quarter of this year saw a 74% surge compared to the same period last year.
Thanks to their reliance on uninterrupted online services and real-time digital transactions, financial organizations accounted for 43.6% of these attacks, with eCommerce firms the victim in 22.6% of cases and ICT services accounting for 18.2%.
Meanwhile, the second quarter also saw the emergence of the largest DDoS botnet ever recorded, consisting of 4.6 million infected devices. To put this in context, this is more than 3.5 times larger than the previous record and nearly 20 times larger than the biggest botnet identified in all of 2024.
“The explosive growth of application-layer DDoS attacks is a direct consequence of the rapidly expanding number of vulnerable devices with fast internet connections,” said Andrey Leskin, chief technology officer at Qrator Labs.
“The size of botnets we observe today would have been unimaginable just a year ago. An attack launched by a botnet of this scale, if not properly mitigated, can generate tens of millions of requests, overwhelming online services until websites become inaccessible, critical transactions fail, and entire digital operations come to a halt."
DDoS attacks targeting the network and transport layers - layers 3 and four - got bigger, with 43% more attacks exceeding 1 Gbps than in the same period last year.
The longest targeted online gambling providers and lasted just over four days.
Typical application layer DDoS attack methods
As for the application layer, layer 7, most attacks were classified as Request Rate Patterns.
The top three countries from which layer 7 DDoS attacks originated during the quarter were the same as last year: Russia accounted for 17%, the US for 16.6%, and Brazil for 13.2%.
Researchers noted that the longest Layer 7 DDoS attack in Q2 2025 lasted 65.5 hours.
Qrator Labs said organizations should enhance their incident response plans, invest in advanced DDoS mitigation services and conduct regular infrastructure stress testing to ensure resilience.
"Not every DDoS protection provider is equipped to handle an assault of this magnitude, which means that even businesses with defenses in place may find themselves unprepared for the impact,” said Leskin.
Last month, research from Akamai Technologies and FS-ISAC, a not-for-profit cybersecurity organization for the financial sector, found that application layer DDoS attacks against the financial sector rose by 23% between 2023 and 2024.
The sector remained the leading target for volumetric DDoS attacks year over year, with a major spike in October last year.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- How to recover from a DDoS attack – and what they can teach businesses
- DDoS attackers are pouncing on unpatched vulnerabilities
- A disgruntled ex-Disney employee targeted former colleagues with DDoS attacks
-
Generative AI enthusiasm continues to beat out business uncertaintyAnalysis Massive data center buildout makes up a significant portion of IT spending, as hyperscalers make hay
-
Pegasystems teams up with AWS to supercharge IT modernizationNews The duo aim to create deeper ties between the Blueprint, Bedrock, and Transform services
-
Arrests made after huge HMRC scam campaign hit 100,000 accountsNews The Romanian nationals are accused of having used stolen data to make fraudulent claims
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaosNews Thousands of ransomware cases have already been posted on the dark web this year
-
Ingram Micro cyber attack: IT distributor says system restoration underway – but some customers might have to wait for a return to normalityNews Ingram Micro is gradually getting back on its feet after a recent cyber attack severely disrupted systems.
-
M&S chair calls for mandatory reporting of cyber attacks after "traumatic" ransomware incident – but will it do more harm than good?News M&S chair Archie Norman has called for mandatory reporting amid claims two large UK companies were hacked without any public knowledge.
-
Arrests made in hunt for hackers behind cyber attacks on M&S and Co-opNews The suspects remain in custody for questioning by officers from the NCA's National Cyber Crime Unit
-
Ransomware attacks carry huge financial impacts – but CISO worries still aren’t stopping firms from paying outNews Increased anxiety over ransomware links directly to its devastating impact on business processes and one’s bottom line
-
‘The worst thing an employee could do’: Workers are covering up cyber attacks for fear of reprisal – here’s why that’s a huge problemNews More than one-third of office workers say they wouldn’t tell their cybersecurity team if they thought they had been the victim of a cyber attack.
-
Developers face a torrent of malware threats as malicious open source packages surge 188%News Researchers have identified more than 16,000 malicious open source packages across popular ecosystems
