DDoS attacks on South Africa jump 78% in 6 months

South Africa absorbed 306,661 distributed denial-of-service (DDoS) attacks in the first half of 2026, up 78% from the 171,812 recorded in the second half of 2025. Year on year, the count was up 44% from 213,523 attacks in the first half of 2025.

The figures come from network security company NETSCOUT, whose DDoS Threat Intelligence Report for January to June 2026 was released on 15 October 2026. Worldwide, NETSCOUT counted more than 9.1 million attacks in the period, a 14% rise on the second half of 2025, so South Africa’s increase ran well ahead of the global trend. The country numbers come from NETSCOUT’s country-level threat data, which it says its ATLAS collection platform generates automatically.

Mobile networks take the brunt

Wireless telecommunications carriers were by far the most-attacked sector in South Africa, absorbing 235,746 attacks, or about 77% of the national total. Those attacks lasted an average of 51 minutes.

Other computer-related services followed with 23,433 attacks, then insurance agencies and brokerages with 9,201. Hosting and data-processing providers faced fewer attacks, at 6,303, but those lasted far longer, averaging 349 minutes.

Across all sectors, the average attack in South Africa lasted 68.3 minutes, down from more than 74 minutes in late 2025, when the country ranked first in the world for attacks on several sectors including commercial banking and insurance. The largest single attack this year combined 25 different attack vectors.

Morocco, Mauritius and Kenya follow

South Africa remains Africa’s most-attacked country by a wide margin in NETSCOUT’s data. Morocco was second with 153,429 attacks, followed by Mauritius with 56,581 and Kenya with 56,544.

As in South Africa, mobile carriers were the most-attacked sector in Morocco and Mauritius, while Kenya’s wired telecommunications carriers narrowly outranked its wireless operators. Attack length varied widely: Moroccan attacks averaged under 13 minutes, while Gabon’s averaged more than 16 hours.

Nigeria recorded 4,549 attacks during the period, while Ghana recorded 715.

Bigger attacks from harder-to-block sources

Globally, attacks exceeding 1 terabit per second (Tbps) or 1 gigapacket per second (Gpps) rose 1,286% year on year. NETSCOUT also recorded its first IPv6 attack above 1Tbps, while active mitigation of IPv6 attacks rose by more than 300%.

Direct-path attacks made up 64.4% of the total, gaining share for a third consecutive half-year. Carpet bombing, which spreads traffic across many destinations to stay under per-host detection thresholds, rose from 3.97% of attacks in the first half of 2025 to 4.54% a year later.

The share of attacks lasting one minute or less climbed from 1.6% in the second half of 2025 to 3.1%, a shift NETSCOUT links to DDoS-for-hire services. Its ASERT research team also found residential proxy networks, which route traffic through ordinary home connections, supplying attack traffic that is harder to tell apart from legitimate users.

“The 1,286% rise in attacks clearing 1Tbps or 1Gpps means high-capacity events are no longer anomalies; they are routine,” said Hardik Modi, VP Engineering, DDoS Solutions, and ASERT Threat Intelligence Team at NETSCOUT.

Why it matters

NETSCOUT argues that attacks increasingly disrupt services without saturating a link, because connection tables and application capacity can fail first. “Providers and enterprises alike need finer-grained, selective mitigation and increased scrubbing capacity at network edges to combat these qualitative shifts in attack sophistication,” Modi said.

For South Africa, where mobile carriers absorb most of the volume, that puts pressure on operators sitting at the centre of the country’s internet infrastructure. Earlier tech.africa coverage set out how African organisations can limit and recover from cyber incidents.

NETSCOUT’s next half-yearly report will show whether the first-half surge marks a new baseline for the country.