DDoS Attacks in APAC in Q2 2026: StormWall Report

Between April and June 2026, telecommunications and entertainment were the most heavily targeted industries in APAC. Application-layer attacks grew more powerful, and botnets continued to expand. 

This report explores the main DDoS trends across APAC in Q2 2026, from evolving attack methods and botnet growth to the industries and countries most affected. 

Key Takeaways

We mitigated 1.72 million DDoS attacks targeting our APAC customers in Q2 2026, an 83% increase year over year.

Our findings reveal several important shifts in the regional threat landscape:

• Commercially motivated attacks dominated: 76% of attacks were aimed at financial gain or competitive advantage, while hacktivist activity accounted for 24%.
• Telecommunications and entertainment faced the greatest pressure: Together, they accounted for 45% of observed attacks.
• Layer 7 attacks became more powerful: Average attack power increased 2.5-fold compared with Q1 2026.
• AI-assisted attacks continued to grow: Their number rose 32% year over year.
• Multi-vector campaigns became more common: Their number increased 62% year over year.
• Botnets grew larger: The average number of devices involved in an attack quadrupled, from 15,000 to 60,000.
• China and India accounted for the largest shares of incidents, at 21% and 20%, respectively, followed by Indonesia at 13%.

The sections below examine these trends, how they affected different industries and countries, and what they mean for organizations operating across APAC.

Commercial Campaigns Take the Lead

Financially motivated attacks dominated the DDoS landscape in APAC during Q2 2026. Attackers sought to disrupt services, put pressure on businesses, and gain a competitive advantage.

Attack Motivation	Share of Attacks	Main Objective
Commercial	76%	Service disruption and financial pressure
Hacktivism	24%	Activity linked to geopolitical events

This distribution contrasts with our global findings, according to which hacktivist groups were responsible for more than 70% of observed attacks in Q2 2026. Much of this activity was associated with the Russia-Ukraine war and conflicts in the Middle East.

The difference highlights how attackers’ motivations vary by region, influencing their choice of targets and the techniques they use.

Layer 7 Attacks Grow 2.5× More Powerful 

The average intensity of application layer attacks (L7) increased 2.5× compared with Q1 2026. These campaigns target websites, applications, login pages, and APIs.

Unlike volumetric attacks, Layer 7 campaigns do not need to overwhelm an organization’s internet connection to disrupt services. They can exhaust application resources, database connections, or computationally expensive API requests, while generating relatively modest amounts of traffic.

Globally, Layer 7 attack volume rose 82% year over year, with attackers making greater use of automation and residential proxy networks.

For APAC organizations, network capacity alone is becoming a less reliable measure of resilience. Effective protection must distinguish malicious application requests from legitimate user activity, particularly when APIs and business-critical transactions are involved.

AI-Assisted Attacks Up 32% YoY

AI-assisted attacks became more common across APAC, as attackers used AI tools to identify potential targets, automate campaign preparation, vary request patterns, and coordinate activity across multiple vectors.

Our global telemetry shows a similar trend: AI-assisted attacks accounted for approximately 34% of DDoS incidents worldwide, up from 22% in Q1 2026. Mentions of malicious AI tools on dark web channels also increased 219% year over year.

These figures suggest that AI is becoming a more prominent part of the DDoS threat landscape, helping attackers automate tasks and adapt their techniques.

Multi-Vector Attacks Up 62% YoY

Multi-vector attacks combine two or more methods within a single campaign. Their number increased 62% year over year in APAC.

Vectors Per Attack	Share of All Attacks
1	73%
2	15%
3	7%
4	3%
5 or more	2%

Overall, 27% of attacks involved multiple vectors. Most multi-vector attacks combined two methods, while approximately 12% used three or more.

By targeting different layers of infrastructure at once, attackers can make campaigns more difficult to mitigate with defenses designed for a single type of threat.

Average Botnet Size Quadruples

The average number of devices involved in botnet attacks against our APAC customers increased fourfold between Q2 2025 and Q2 2026.

Period	Average Devices Per Botnet Attack
Q2 2025	15,000
Q2 2026	60,000

The disruption of the Aisuru, Kimwolf, JackSkid, and Mossad botnets in March 2026 did not produce a lasting decline in attack volumes. Instead, we observed attackers shifting to other botnets, including Masjesu, xlabs_v1, more than 116 active Mirai-derived variants, and RapperBot.

APAC remains an important part of this ecosystem because the region has a large pool of consumer routers, cameras, Android TV boxes, and other internet-connected devices vulnerable to automated exploitation. During the first half of 2026, Singapore, China, and Indonesia were among the world’s leading sources of DDoS traffic.

This supply of vulnerable devices helps sustain DDoS-for-hire services. Taking down one botnet can disrupt its operators, but other compromised devices can quickly replenish the available attack capacity.

DDoS Attacks in APAC by Industry

Telecommunications and entertainment were the most heavily targeted industries in APAC in Q2 2026, together accounting for 45% of all attacks we mitigated. The government sector ranked third, followed by finance and retail.

Share of DDoS attacks by industry:

And, YoY growth:

The distribution has shifted considerably since 2025. Telecommunications’ share rose from 18% to 26%, while entertainment nearly doubled its share, from 10% to 19%. Finance and manufacturing also accounted for a larger proportion of attacks. The government sector, by contrast, saw its share fall from 27% to 16%, even as the absolute number of attacks against the sector continued to grow.

How Attack Patterns Differ by Industry

The methods attackers used varied across sectors, reflecting differences in infrastructure and the services they sought to disrupt.

Telecommunications faced the sharpest year-over-year increase in attack volume, which more than doubled. Network-layer floods were responsible for over 86% of attacks, and average attack bandwidth was five times higher than a year earlier.

Attack Vector	Share of Attacks
TCP floods	35%
UDP floods	30%
ICMP floods	23%
HTTP floods	10%
Other	2%

Entertainment saw average attack bandwidth increase 2.5×. UDP floods were the most common method, particularly in attacks against gaming platforms and other real-time services.

Attack Vector	Share of Attacks
UDP floods	36%
HTTP floods	28%
SYN floods	19%
DNS floods	10%
Other	7%

Government organizations remained a target for politically motivated campaigns despite its smaller share of total attacks. In April, hacktivist groups targeted South Korea’s Ministry of Foreign Affairs, Ministry of Trade, Industry and Energy, Korea Land & Housing Corporation, and Korea Hydro & Nuclear Power. The Ministry of Foreign Affairs website was briefly taken offline.

HTTP floods accounted for the largest share of attacks targeting government organizations.

Attack Vector	Share of Attacks
HTTP floods	40%
SYN floods	23%
DNS floods	18%
UDP floods	14%
Other	5%

These differences highlight why DDoS protection needs to address both network- and application-layer threats. Telecom providers must be prepared for high-volume traffic floods, entertainment platforms need to protect real-time services and applications, and government organizations must account for politically motivated attacks designed to disrupt public-facing systems.

DDoS Attacks by Country

China and India were the most frequently targeted countries in APAC in Q2 2026, together accounting for 41% of incidents recorded by StormWall. Indonesia ranked third.

Compared with Q1 2026, the shares of attacks attributed to China, India, Indonesia, Malaysia, South Korea, and Australia all increased. South Korea recorded one of the sharpest changes, with its share rising from 6% to 9% amid a wave of politically motivated campaigns against government institutions and companies in April.

Singapore, Hong Kong, Japan, and Taiwan represented smaller shares of regional activity than in the previous quarter. However, a decline in relative share does not necessarily mean that fewer incidents affected organizations in these markets: total DDoS volume across APAC remained substantially higher than a year earlier.

Network-layer telemetry revealed a further trend in Hong Kong, which accounted for more than 40% of observed attack bytes in Q2, compared with approximately 19% in Q1. Although its share of attack counts decreased, the amount of malicious traffic directed at infrastructure serving the market remained substantial.

What These Trends Mean for APAC Organizations

StormWall’s Q2 2026 data highlights several developments that security teams should consider when assessing their exposure to DDoS threats.

Commercially motivated campaigns are becoming a defining feature of the regional threat landscape. Businesses that rely on uninterrupted digital services face risks ranging from lost revenue to customer churn and competitive pressure.

Network capacity alone cannot guarantee resilience. The increase in Layer 7 attack intensity demonstrates why organizations must also protect application resources, APIs, and other critical endpoints.

Campaigns are becoming more complex. AI-assisted techniques, multi-vector methods, and larger botnets give adversaries more ways to adapt their approach and sustain pressure on targets.

No single industry or country has a monopoly on risk. Telecommunications and entertainment faced the greatest share of incidents, while financial services recorded strong growth. Government organizations remain vulnerable to politically motivated operations, and botnet infrastructure continues to draw on devices and networks across the region.

Organizations across APAC need DDoS protection that can mitigate large network-layer floods, identify application-layer abuse, and respond to campaigns combining several techniques. Continuous monitoring and the ability to adapt defenses as attack patterns evolve are equally important.

Conclusion

DDoS activity across APAC in Q2 2026 reflected two concurrent trends: commercially motivated campaigns dominated the regional landscape, while hacktivist attacks continued to disrupt organizations during periods of geopolitical tension. Larger botnets, AI-assisted tools, and multi-vector techniques added to the scale and complexity of these threats.

For organizations, resilience requires more than the capacity to absorb high-volume floods. It also depends on detecting sophisticated application-layer attacks, distinguishing malicious requests from legitimate traffic, and responding to campaigns that target several layers of infrastructure simultaneously.

We recommend that organizations across APAC deploy modern DDoS protection capable of detecting and mitigating threats across both the network and application layers.