The second quarter of 2025 saw a massive rise in application layer DDoS attacks, new research shows, with financial services firms the biggest target.
Application-layer attacks target web applications and are hard to detect, with malicious traffic closely resembling legitimate user requests. According to researchers at Qrator Labs, the second quarter of this year saw a 74% surge compared to the same period last year.
Thanks to their reliance on uninterrupted online services and real-time digital transactions, financial organizations accounted for 43.6% of these attacks, with eCommerce firms the victim in 22.6% of cases and ICT services accounting for 18.2%.
Meanwhile, the second quarter also saw the emergence of the largest DDoS botnet ever recorded, consisting of 4.6 million infected devices. To put this in context, this is more than 3.5 times larger than the previous record and nearly 20 times larger than the biggest botnet identified in all of 2024.
“The explosive growth of application-layer DDoS attacks is a direct consequence of the rapidly expanding number of vulnerable devices with fast internet connections,” said Andrey Leskin, chief technology officer at Qrator Labs.
“The size of botnets we observe today would have been unimaginable just a year ago. An attack launched by a botnet of this scale, if not properly mitigated, can generate tens of millions of requests, overwhelming online services until websites become inaccessible, critical transactions fail, and entire digital operations come to a halt."
DDoS attacks targeting the network and transport layers - layers 3 and four - got bigger, with 43% more attacks exceeding 1 Gbps than in the same period last year.
The longest targeted online gambling providers and lasted just over four days.
Typical application layer DDoS attack methods
As for the application layer, layer 7, most attacks were classified as Request Rate Patterns.
The top three countries from which layer 7 DDoS attacks originated during the quarter were the same as last year: Russia accounted for 17%, the US for 16.6%, and Brazil for 13.2%.
Researchers noted that the longest Layer 7 DDoS attack in Q2 2025 lasted 65.5 hours.
Qrator Labs said organizations should enhance their incident response plans, invest in advanced DDoS mitigation services and conduct regular infrastructure stress testing to ensure resilience.
"Not every DDoS protection provider is equipped to handle an assault of this magnitude, which means that even businesses with defenses in place may find themselves unprepared for the impact,” said Leskin.
Last month, research from Akamai Technologies and FS-ISAC, a not-for-profit cybersecurity organization for the financial sector, found that application layer DDoS attacks against the financial sector rose by 23% between 2023 and 2024.
The sector remained the leading target for volumetric DDoS attacks year over year, with a major spike in October last year.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- How to recover from a DDoS attack – and what they can teach businesses
- DDoS attackers are pouncing on unpatched vulnerabilities
- A disgruntled ex-Disney employee targeted former colleagues with DDoS attacks
-
Twilio names Jake Kanter as new vice president of sales for EMEANews Kanter will leverage more than a decade’s worth of Twilio leadership experience to spearhead the vendor’s sales operations in the region
-
Salesforce just launched a new catch-all platform to build enterprise AI agentsNews Businesses will be able to build agents within Slack and manage them with natural language
-
Third time lucky? The FBI just took down BreachForums, againNews The hacking forum is down for now, but the group behind it, Scattered Lapsus$ Hunters, isn't going to stop extorting victims of the Salesforce breach
-
Critical networks face unprecedented threat as DDoS attacks are getting shorter and more intensenews Attackers have stepped up their intrusions into core networks, according to Nokia's 11th annual Threat Intelligence Report
-
A malicious MCP server is silently stealing user emailsNews Koi Security says it's discovered the first malicious MCP server in the wild, exposing a risk to the entire ecosystem
-
NCA confirms arrest after airport cyber disruptionNews Disruption is easing across Europe following the ransomware incident
-
Cyber skills shortages are pushing firms into dangerous shortcuts – and it’s putting them at huge risk of security breachesNews Chronic cyber skills shortages mean many businesses are implementing quick fixes
-
Pentesters are now a CISOs best friend as critical vulnerabilities skyrocketNews Attack surfaces are expanding rapidly, but pentesters are here to save the day
-
Hackers are disguising malware as ChatGPT, Microsoft Office, and Google Drive to dupe workersNews Beware of downloading applications like ChatGPT, Microsoft Office applications, and Google Drive through search engines
-
Generative AI attacks are accelerating at an alarming rateNews Two new reports from Gartner highlight the new AI-related pressures companies face, and the tools they are using to counter them
