Football and Fisticuffs: DDoS Strikes Media in 2026
Ongoing conflicts in Ukraine and Iran, along with the FIFA World Cup, have significantly contributed to a DDoS strike against media organizations throughout 2026 to date, as reported by Cloudflare’s recent data, which identified this sector as the most assaulted this year. Incidents targeting media, production, and publishing represented 14.2 percent of all DDoS attacks initiated since January 1. In the initial half of the year, this sector experienced nearly four times the frequency of attacks aimed at the second most-threatened sector, gambling and casinos, and six times more during Q2 alone.
“DDoS strikes on media organisations can be notably effective in achieving their primary objectives, which are fundamentally different from those targeting other sectors,” Blake Darché, Head of Cloudforce One and Threat Intelligence at Cloudflare, communicated to GadgetLad. “For publishers, the deliverable is availability. In contrast, a DDoS strike on an e-commerce platform may aim to hijack transaction revenue, while an attack on a publisher usually seeks censorship, suppression of information, or disruption of timing.
“DDoS strikes are particularly potent against publishers because news has a short lifespan – taking an outlet offline for just two hours during election night, a military engagement, or a breaking news event effectively silences it at peak readership. The attack is deemed successful even if systems recover shortly thereafter.”
War-Time Web Troubles
Cloudflare’s findings are consistent with third-party reports that emerged shortly after the US commenced a conflict with Iran in February. Akamai reported a 245 percent surge in cybercrime in the weeks following the outbreak of the war, with DDoS attacks increasing by 38 percent. Furthermore, Justin Moore, senior manager at Palo Alto Networks’ Unit 42, previously informed GadgetLad that by early March, the company’s telemetry indicated a clear rise in pro-Russia hacktivism as well.
Hacktivists rely predominantly on DDoS assaults to fulfill their goals. Often organized on social media platforms, hacktivist groups determine which organizations to target and coordinate their attacks against them. Signals intelligence agencies assert that these efforts are typically low-level and low-impact, yet they caution that businesses should not underestimate these groups. This advice is particularly relevant for operators of critical infrastructure, as successful and sustained attacks could lead to significant service disruptions.
Governments and Games Under Attack
The US’ conflict in Iran also resulted in a substantial increase in attacks aimed at governmental entities. From the 29th most-targeted sector in Q1, it escalated to the ninth position in Q2. The US and China were identified as the two most targeted regions, with Turkey climbing to third after hosting the Ankara NATO summit in July.
1 Tbps Network-Layer Attacks Surge
Cloudflare reported mitigating 805 network-layer attacks exceeding 1 Tbps in Q2 alone, indicating a 519 percent rise compared to Q1. To clarify some terminology for those unfamiliar, network-layer attacks are limited to layer 3 of the Open Systems Interconnection (OSI) model, which means they focus on core routing, transport, and infrastructure protocols to overwhelm networking equipment.
Not all attacks surpassing 1 Tbps target the network layer. These high-packet attacks are termed hyper-volumetric DDoS attacks and involve sending an enormous amount of data to a network – sufficient to incapacitate even the strongest internet infrastructure. Even with the rise in such hyper-volumetric attacks, they only represent a minuscule fraction of overall DDoS attacks (0.004 percent). The overwhelming majority – 96.62 percent – transmit less than 500 Mbps, and 90.6 percent conclude in under ten minutes. That’s not to imply these attacks lack importance, however. Cloudflare indicated that even assaults of this magnitude could be enough to take most networks offline.
Don’t Underestimate a DDoS by Its Size
For perspective, the company stated that a 100 Mbps attack would be adequate to take a website or server offline, while a 1 Gbps attack could disrupt an entire data center if it lacked protection against DDoS attacks. 1 Tbps hyper-volumetric attacks rank among the fastest ever observed. The first recorded attack of this kind targeted Dyn DNS in 2016, causing major websites such as Twitter, Netflix, Reddit, Spotify, and GitHub to go down, and they have become increasingly prevalent since, despite their significantly low proportion relative to other DDoS attacks.
Botnets on the Loose
A law enforcement operation in March dismantled the infrastructure used by four of the most notable botnets active at that time, including Aisuru, which had by late 2025 enlisted up to 4 million devices and was launching multiple 1 Tbps attacks daily. Hyper-volumetric assaults are often brief, measured in seconds rather than longer intervals, although Cloudflare noted that even this duration is sufficient to inflict considerable damage.
“Whether an attack endures for thirty seconds or ten minutes, there is no viable window for human intervention: By the time an alert reaches a security analyst, the attack has already concluded,” Cloudflare stated in its report. “Manual mitigation and on-demand solutions are simply too sluggish for this reality. However, while the attack itself may be fleeting, its repercussions are not. The cascading effects of even a brief burst can induce routing instability, TCP retransmissions, application timeouts, and downstream service degradation that may take hours or days to completely resolve – all while services remain offline or compromised.”
Image caption: Wars, World Cup and DDoS Mayhem ©
Summary: Attack of the Clones
DDoS attacks are quite the nuisance for media professionals, especially when everyone is clamoring for headline news platforms with as much enthusiasm as they have for placing bets or ranting half-baked football commentary! GadgetLad advises to brace yourself, secure your networks, and the next time you observe your servers crashing more dramatically than a Geordie’s night out, don’t say I didn’t caution you!
