The second quarter of 2025 saw a massive rise in application layer DDoS attacks, new research shows, with financial services firms the biggest target.
Application-layer attacks target web applications and are hard to detect, with malicious traffic closely resembling legitimate user requests. According to researchers at Qrator Labs, the second quarter of this year saw a 74% surge compared to the same period last year.
Thanks to their reliance on uninterrupted online services and real-time digital transactions, financial organizations accounted for 43.6% of these attacks, with eCommerce firms the victim in 22.6% of cases and ICT services accounting for 18.2%.
Meanwhile, the second quarter also saw the emergence of the largest DDoS botnet ever recorded, consisting of 4.6 million infected devices. To put this in context, this is more than 3.5 times larger than the previous record and nearly 20 times larger than the biggest botnet identified in all of 2024.
“The explosive growth of application-layer DDoS attacks is a direct consequence of the rapidly expanding number of vulnerable devices with fast internet connections,” said Andrey Leskin, chief technology officer at Qrator Labs.
“The size of botnets we observe today would have been unimaginable just a year ago. An attack launched by a botnet of this scale, if not properly mitigated, can generate tens of millions of requests, overwhelming online services until websites become inaccessible, critical transactions fail, and entire digital operations come to a halt."
DDoS attacks targeting the network and transport layers - layers 3 and four - got bigger, with 43% more attacks exceeding 1 Gbps than in the same period last year.
The longest targeted online gambling providers and lasted just over four days.
Typical application layer DDoS attack methods
As for the application layer, layer 7, most attacks were classified as Request Rate Patterns.
The top three countries from which layer 7 DDoS attacks originated during the quarter were the same as last year: Russia accounted for 17%, the US for 16.6%, and Brazil for 13.2%.
Researchers noted that the longest Layer 7 DDoS attack in Q2 2025 lasted 65.5 hours.
Qrator Labs said organizations should enhance their incident response plans, invest in advanced DDoS mitigation services and conduct regular infrastructure stress testing to ensure resilience.
"Not every DDoS protection provider is equipped to handle an assault of this magnitude, which means that even businesses with defenses in place may find themselves unprepared for the impact,” said Leskin.
Last month, research from Akamai Technologies and FS-ISAC, a not-for-profit cybersecurity organization for the financial sector, found that application layer DDoS attacks against the financial sector rose by 23% between 2023 and 2024.
The sector remained the leading target for volumetric DDoS attacks year over year, with a major spike in October last year.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- How to recover from a DDoS attack – and what they can teach businesses
- DDoS attackers are pouncing on unpatched vulnerabilities
- A disgruntled ex-Disney employee targeted former colleagues with DDoS attacks
-
Google CEO Sundar Pichai says vibe coding has made software development ‘exciting again’News Google CEO Sundar Pichai claims software development has become “exciting again” since the rise of vibe coding, but some devs are still on the fence about using AI to code.
-
15-year-old revealed as key player in Scattered LAPSUS$ HuntersNews 'Rey' says he's trying to leave Scattered LAPSUS$ Hunters and is prepared to cooperate with law enforcement
-
The Scattered Lapsus$ Hunters group is targeting Zendesk customers – here’s what you need to knowNews The group appears to be infecting support and help-desk personnel with remote access trojans and other forms of malware
-
Impact of Asahi cyber attack laid bare as company confirms 1.5 million customers exposedNews No ransom has been paid, said president and group CEO Atsushi Katsuki, and the company is restoring its systems
-
If you're not taking insider threats seriously, then the CrowdStrike incident should be a big wake up callNews CrowdStrike has admitted an insider took screenshots of systems and shared them with hackers, and experts say it should serve as a wake up call for enterprises globally.
-
Shai-Hulud malware is back with a vengeance and has hit more than 19,000 GitHub repositories so far — here's what developers need to knowNews The malware has compromised more than 700 widely-used npm packages, and is spreading fast
-
Security experts claim the CVE Program isn’t up to scratch anymore — inaccurate scores and lengthy delays mean the system needs updatedNews CVE data is vital in combating emerging threats, yet inaccurate ratings and lengthy wait times are placing enterprises at risk
-
The US, UK, and Australia just imposed sanctions on a Russian cyber crime group – 'we are exposing their dark networks and going after those responsible'News Media Land offers 'bulletproof' hosting services used for ransomware and DDoS attacks around the world
-
Thousands of ASUS routers are being hijacked in a state-sponsored cyber espionage campaignNews Researchers believe that Operation WrtHug is being carried out by Chinese state-sponsored hackers
-
IBM AIX users urged to patch immediately as researchers sound alarm on critical flawsNews Network administrators should patch the four IBM AIX flaws as soon as possible
