DDoS botnet grows to 13.5 million devices, 2 Tbps attacks hit fintech and betting industries

Per HackRead, a new report from Qrator Labs indicates a significant escalation in distributed denial of service (DDoS) attacks, with the largest botnet expanding to 13.5 million devices and the capacity for 2 Tbps assaults. The first quarter of 2026 saw the fintech and betting sectors bearing the brunt of these increasingly sophisticated cyber threats.

The Qrator Labs report reveals that the primary botnet has grown tenfold in one year, now comprising 13.5 million compromised devices globally, primarily located in the United States, Brazil, and India. Attackers are increasingly utilizing the Aeternum C2 botnet loader, which leverages the Polygon blockchain for command and control, making it difficult to dismantle due to its decentralized nature. Multi-vector DDoS attacks also saw an increase, rising from 8.0% to 10.7% of incidents. A notable attack in mid-March 2026 against a betting company peaked at 2.065 Tbps and persisted for 40 minutes, with attackers altering their strategy 11 times. The fintech sector was the most targeted, accounting for 44.2% of incidents, followed by banks (22.8%) and payment systems (15.9%). Information technology companies and betting shops were also significant targets.

The report highlights that traditional defense mechanisms are becoming less effective as botnets become larger and more geographically dispersed. The rise of multi-vector attacks, combining network and application layer methods, presents a growing challenge for organizations. Furthermore, the persistent threat of bad bots, used for activities like data scraping, saw a 12% increase in blocked requests year-over-year.

Source: HackRead