NETSCOUT’s DDoS Threat Intelligence Report for January to June 2026, released on 15 October, contains a number that demands attention from every organisation operating digital infrastructure in South Africa.
306,661 distributed denial-of-service attacks hit South African targets in the first half of this year. That is up 78% from the 171,812 recorded in the second half of 2025, and up 44% year on year from the first half of 2025. Globally, NETSCOUT rose 14% over the same period. South Africa’s increase ran at more than five times the global rate.
South Africa remains Africa’s most attacked country by a significant margin. Morocco was second with 153,429 attacks. Mauritius and Kenya followed with just over 56,000 each. Nigeria recorded 4,549.
Who is absorbing the attacks?
Mobile carriers absorbed most of South Africa’s DDoS volume, taking 235,746 attacks, roughly 77% of the national total. Those attacks lasted an average of 51 minutes each.
Insurance agencies and brokerages were the third most targeted sector with 9,201 attacks. Hosting and data-processing providers faced fewer attacks at 6,303, but those lasted far longer, averaging 349 minutes each.
The average attack duration across all South African sectors was 68.3 minutes. The largest single attack this year combined 25 different attack vectors simultaneously.
The concentration on mobile carriers is significant in the South African context. Mobile networks are not simply a consumer convenience. They are the connectivity layer underpinning digital banking, payment processing, IoT infrastructure, remote access to enterprise systems and government services. When mobile carriers absorb sustained DDoS attacks, the downstream operational impact extends well beyond the carrier itself into every organisation and individual dependent on that connectivity.
The technical shifts that matter for defenders.
NETSCOUT’s report identifies several trends in how DDoS attacks are being executed that have direct implications for how organisations defend against them.
Globally, attacks exceeding one terabit per second or one gigapacket per second rose 1,286% year on year. NETSCOUT recorded its first IPv6 attack above 1Tbps, while active mitigation of IPv6 attacks rose by more than 300%. High-capacity events, once anomalies, are now routine.
Direct-path attacks made up 64.4% of the global total, gaining share for a third consecutive half-year. These attacks originate directly from attacker-controlled infrastructure rather than through amplification techniques, making them harder to filter using traditional source-based blocking.
The share of attacks lasting one minute or less climbed from 1.6% to 3.1%, a shift NETSCOUT links directly to DDoS-for-hire services. Short, sharp attacks are increasingly used to probe defences, test thresholds and identify mitigation gaps before a more sustained campaign is launched. Carpet bombing, which distributes traffic across many destinations to stay below per-host detection thresholds, rose from 3.97% to 4.54% of attacks.
Residential proxy networks, which route attack traffic through ordinary home internet connections, are increasingly supplying DDoS traffic that is genuinely difficult to distinguish from legitimate users. A defence model that relies on identifying attack sources by IP reputation or geography becomes progressively less effective when the source looks like a domestic broadband customer.
NETSCOUT’s VP of Engineering Hardik Modi summarised the operational implication directly: attacks increasingly disrupt services without saturating a link, because connection tables and application capacity can fail first. Providers and enterprises need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts.
What the insurance sector’s exposure tells us.
The appearance of insurance agencies and brokerages as South Africa’s third most targeted DDoS sector, with 9,201 attacks in six months, sits in uncomfortable proximity to everything the sector has experienced through the MIP Holdings breach and its downstream consequences in recent weeks.
DDoS attacks are not always simply about disruption. They are documented as a pressure tactic in ransomware and extortion campaigns, as a smokescreen for concurrent intrusion attempts, and as a tool to overwhelm security operations teams during a period when an attacker is attempting something else entirely elsewhere in the environment.
An insurance sector that is already managing active ransomware investigations, Information Regulator scrutiny and customer notifications across multiple organisations simultaneously is a sector whose security operations capacity is under pressure. That is precisely the kind of environment where a sustained DDoS campaign creates maximum operational disruption for minimum attacker effort.
The DCDT’s framing this week is the right one.
On 16 October, TechCentral published a piece by the Director-General of the Department of Communications and Digital Technologies framing cybersecurity explicitly as a national security issue rather than a technical one. The CSIR’s national surveys found 88% of respondents had suffered at least one security breach, and 47% of organisations reported between one and five cybersecurity incidents in the previous year.
The NETSCOUT data released this week gives that framing a specific and measurable dimension. South Africa is not experiencing a marginal increase in DDoS attack volume. It is experiencing a surge that runs at five times the global rate, concentrated on the mobile infrastructure that underpins the country’s digital economy, at a time when the broader threat environment is more active than at any point in recent memory.
DDoS resilience is not a specialist concern for telcos and hosting providers. It is a business continuity question for every organisation whose operations depend on connectivity, payment processing or cloud-hosted services that sit behind infrastructure absorbing nearly 60,000 attacks every month.
SS-Consulting helps South African organisations assess their exposure to DDoS and availability-based threats and build resilience frameworks that account for the operational consequences of sustained attacks. www.ss-consulting.co.za
