This marks a 78% surge from the previous six months and a 44% year-on-year increase. The figures, released on 15 October 2026, highlight South Africa’s position as a major target in the global DDoS environment.
The country’s rise in attacks outpaced the global trend, where NETSCOUT recorded over 9.1 million attacks, a 14% rise. South Africa’s mobile networks bore the brunt, with wireless carriers facing 235,746 attacks, or 77% of the total. This concentration on mobile infrastructure shows the sector’s vulnerability in the nation’s digital ecosystem.
Mobile Networks Under Fire
Wireless carriers in South Africa were the primary target, enduring 235,746 attacks, each lasting an average of 51 minutes. Other sectors, like computer services and insurance, also faced significant attacks, but with varying durations. Computer-related services experienced 23,433 attacks, while insurance agencies and brokerages faced 9,201. Hosting and data-processing providers, though attacked less frequently at 6,303 incidents, saw much longer durations, averaging 349 minutes.
The average attack duration in South Africa was 68.3 minutes, down from over 74 minutes in late 2025. The largest single attack in 2026 employed 25 different methods, showcasing the sophistication of these malicious campaigns.
Regional Comparison
South Africa leads Africa in DDoS attacks, with 306,661 incidents, followed by Morocco (153,429), Mauritius (56,581), and Kenya (56,544). Attack patterns varied across countries, with mobile carriers targeted in Morocco and Mauritius, while Kenya’s wired carriers faced more attacks. Attack durations differed significantly, from under 13 minutes in Morocco to over 16 hours in Gabon. Nigeria and Ghana recorded 4,549 and 715 attacks, respectively, highlighting the disparate impact across the continent.
Global Trends and Challenges
Globally, attacks exceeding 1 terabit per second rose by 1,286%, with NETSCOUT recording its first IPv6 attack above this threshold. Direct-path attacks made up 64.4% of the total, gaining share for a third consecutive half-year. Carpet bombing, which spreads traffic across many destinations to stay under per-host detection thresholds, rose from 3.97% of attacks in the first half of 2025 to 4.54% a year later. The share of attacks lasting one minute or less climbed from 1.6% in the second half of 2025 to 3.1%, a shift NETSCOUT links to the growing prevalence of DDoS-for-hire services.
Hardik Modi, VP of Engineering at NETSCOUT, noted the shift towards high-capacity attacks, emphasizing the need for advanced mitigation strategies. The rise in DDoS-for-hire services and residential proxy networks, which route traffic through ordinary home connections, complicates detection and response. These networks make it harder to distinguish attack traffic from legitimate users, increasing the challenge for cybersecurity professionals.
