02.11.2026 21:50
Kaspersky examines the underground market for DDoS services
Security
Hits: 2
Kaspersky Digital Footprint Intelligence says it examined more than 256,000 DDoS-related posts and identified 148 threat actors active since at least 2024. The research focuses on attack services marketed through subscription-like models.
Dji Banner Inside Article - 728x90
A market observed through 256,000 posts
The 12 October announcement examines how DDoS services are offered across the dark and deep web and how competition shapes that market. Kaspersky reports prices of $30–$2,000 for brokered attacks, depending on targets, duration, limits and features.
Those figures are observations about the listings and service models studied. They do not describe the cost of every completed attack or guarantee identical effects at a given price. The defensive significance lies in low entry costs and ready-made services becoming accessible to more threat actors.
Service models and targeted layers
The report distinguishes outsourcing an attack, DDoS-as-a-Service subscriptions and attacks using the actor’s own infrastructure. It says 65% of the intermediaries studied promoted services on cybercrime forums and 35% through Telegram and Discord. These percentages relate to the actors examined.
Application-layer methods were especially common. Kaspersky reports L7 techniques in 92% of offerings, L4 in 74% and explicit reference only to L3 in 9%. An actor can advertise multiple methods, so these are not mutually exclusive market shares.
Preparing for service disruption
Analyst João Pedro Brandão e Silva links accessible pricing and ready-made tools with DDoS becoming viable for more attackers. Kaspersky recommends including the risk in core security and business-continuity planning.
Monitoring exposed services, connecting threat intelligence with incident response and defining responsibilities before abnormal traffic occurs are parts of preparation. Network-layer protection and web-application needs must be considered together. The research is reported for defensive understanding, without attack-purchasing links or operational instructions.
Sources and further information: Kaspersky DFI research.