Commercial DDoS is growing up

Commercial DDoS Is Growing Up

What a new underground market study tells us

A targeted DDoS attack now costs less than a monthly streaming subscription. That is the uncomfortable headline behind a new underground market study by Kaspersky Digital Footprint Intelligence, and it is why our R&D team took a closer look.

DDoS is no longer just a technique. It is a product. Behind the record-breaking traffic numbers in vendor threat reports sits an organized economy with price lists, subscription tiers, customer support, free trials and marketing channels.

The Report analyzed more than 256,000 posts from the dark and deep web and identified 148 DDoS sellers active since at least 2024, with some traced back to 2015. At zeroBS, our R&D unit continuously monitors developments like these for our clients. Here is our summary of what matters most for defenders; you will find the links to our Botnet Tracking and observed Streetprices below.

Commercial DDoS Service Models

Three ways to buy disruption

The report distinguishes three ways attackers get their hands on DDoS capability. Two of them require no technical skill at all.

Brokered DDoS (DDoS for hire). The buyer contacts a provider and orders an attack on a specific target. The provider does everything else: choosing the method, shaping the traffic and getting around anti-DDoS protection. First contact often happens on a forum, then moves to Telegram or Discord. Prices are negotiated per job.

Pricerange for brokered DDoS / DDoS for hire

DDoS-as-a-Service (DDoSaaS, aka Booter-Services or DDoS-Stressers). The buyer subscribes to a web panel or a Telegram bot and launches attacks themselves. The plan defines methods, maximum attack duration and the number of parallel attacks. Some services offer a free test attack with a single chat command.

Pricerange for DDoS-as-a-Service / aka Booter-Services, Stressers

In-house infrastructure. More capable actors run their own attack scripts on rented servers or build and maintain botnets. Kaspersky counted over 1,000 GitHub repositories with stresser scripts and around 500 more claiming to contain botnet code

Among the 57 actors who sell attacks directly, 65% work as brokers, 29% sell subscriptions and only 6% rely on self-built infrastructure. In other words: most attacks are bought, not built.

The key takeaway: for the two dominant models, the buyer needs a target and a budget, nothing more. Know-how is part of the product.

Commercial DDoS is evolving

The market is not standing still. Five developments stood out to us.

1. More sellers, every year. New DDoS providers stayed rare until 2022. Since 2023 the number has climbed steadily, with 16 new actors in Q1 2026 alone. Kaspersky expects 2026 to beat 2025 by at least 25%. Drivers include hacktivist campaigns fueled by geopolitical tensions and freely available open-source attack tools.

Commercial DDoS Actors Over Time

2. From websites to Telegram.
Classic stresser panels still dominate, but since 2022 more and more sellers offer Telegram bots with built-in attack functions. Today about 27% of DDoSaaS offers run via Telegram. These interfaces are faster to set up and easier to replace when taken down.

3. Bypassing protection is a selling point.
One in three sellers explicitly advertises the ability to get around anti-DDoS protection. The report counts 32 named protection vendors across L4, L7 and game server protection. Sellers increasingly rely on proprietary methods, traffic that imitates real browsers and, in some cases, AI-assisted CAPTCHA solving.

4. Layer 7 is the default.
92% of sellers offer application-layer (L7) attacks, because ready-made methods are easy to find and all a buyer needs is a URL. These attacks target CPU and memory rather than bandwidth and are harder to tell apart from legitimate traffic. 36% of stresser panels still claim Tbps-scale volumetric capacity, though such claims are hard to verify.

5. DDoS as part of a wider toolbox.
43% of providers on criminal forums sell side services: botnet and script sales, VPS rental, mass reporting, spam and even „anti-DDoS“ protection. Some sellers partner with hacktivist groups, using public campaigns as proof of capability. Leaderboard platforms let sellers measure and publicly rank their attack power.

What ties these trends together is accessibility. The barrier to launch a disruptive attack keeps falling, while the attack quality on offer keeps rising.

What this means for defenders

When attacks are cheap, available on demand and built to bypass protection, assumptions are not enough. Kaspersky’s recommendations match what we see in our own testing practice:

Run controlled DDoS simulations.
Test your defenses regularly with stress tests or chaos engineering. Given how cheap and accessible attacks have become, validation should be routine, not a one-off.
Deploy multi-layer DDoS protection.
Cover both volumetric L3/L4 attacks and L7 attacks that target CPU and memory with crafted requests.
Track botnet intelligence.
Enrich detection with known attack infrastructure, indicators of compromise and actor information to block malicious traffic faster.
Automate detection and response.
DDoS attacks unfold within minutes and generate large volumes of telemetry. Manual response is too slow.
Use a CDN and reverse proxy.
Distribute traffic, shield your origin servers and remove single points of failure.
Separate critical services and enable autoscaling. Isolate critical functions from the rest of your infrastructure and scale them quickly when load spikes.

The first point is the one that makes the other five measurable. Protection that has never been tested under realistic attack conditions is a promise, not a proof.

Our take

Commercial DDoS has matured into a service industry with subscriptions, support and competition. Attackers iterate on their product. Defenders need to iterate on theirs, and that starts with knowing how your infrastructure actually behaves under attack.

At zeroBS, we run controlled DDoS stress tests across L3/L4 and L7 and help organizations turn results into evidence for DORA, NIS2 and other compliance requirements. Want to know how your setup holds up against what is for sale today?
Let’s talk.

If you are interested to test your own infrastructure, we run our own DDoS Threat Simulation and Automation Platform, called „Avydos“ that allows you to test anything, anytime, in a controlled way, secure and reliable. All attack-vectors, from IoT-Bots to Browserbots, from simple GET-Floods to sophisticated simulated user-behavrior.
Get in contact