Distributed denial-of-service (DDoS) attacks are available on the darknet for as little as $30, while DDoS-as-a-Service offerings start at $1, according to new research from Kaspersky Digital Footprint Intelligence (DFI).

Brokered DDoS attacks are priced case by case, ranging from $30 to $2,000. Pricing varies depending on factors such as the target, attack duration, service limits and available features.

What the research covered

Kaspersky DFI experts examined how DDoS services are offered across the darknet, how different service models are priced and marketed, how competition shapes the market over time and what behavioral patterns characterize the actors behind the supply.

They analyzed more than 256,000 DDoS-related posts across the dark and deep web and identified 148 DDoS actors active since at least 2024.

11 million game accounts stolen — and APAC is at the heart of it

Three attack models

• Brokered attacks: A third party is hired to carry out the attack
• DDoS-as-a-Service: Users buy a subscription to attack tools such as online control panels or Telegram bots
• In-house infrastructure: Actors run their own attack scripts or botnets

Among observed brokered actors, 65% advertised on cybercriminal forums, while 35% used Telegram and Discord.

Application-layer attacks dominate

DDoS activity is centered on two primary attack types: network-layer attacks, which seek to overwhelm infrastructure with heavy traffic, and application-layer attacks, which aim to disrupt websites and online services directly.

• L7 attacks were the most widely offered, appearing in 92% of cases
• 74% of actors advertised L4 techniques such as TCP (Transmission Control Protocol), UDP (User Datagram Protocol) and DNS (Domain Name System) floods
• Only 9% explicitly referred to standalone L3 methods

The L7 figure underscores both the broad availability of ready-made tools and the relative ease of targeting web-facing services.

A cheap, accessible threat

“DDoS attacks have become a more practical and accessible option for threat actors, largely because these services are cheap and easy to obtain. In some cases, the cost of launching an attack can be lower than a standard monthly streaming subscription, or even for a price of a cup of coffee. For businesses, this means DDoS readiness should be part of basic cybersecurity planning. It is equally important to understand the market behind these attacks, since stronger defense begins with a clearer understanding of the threat environment,” says João Pedro Brandão e Silva, Kaspersky Digital Footprint Intelligence analyst.

How businesses can protect themselves

Kaspersky recommends the following:

• Adopt a comprehensive digital risk protection service that monitors an organization’s digital assets and detects threats across the surface, deep and dark web, such as Kaspersky Digital Footprint Intelligence
• Give InfoSec professionals in-depth visibility into cyberthreats targeting the organization. Kaspersky Threat Intelligence provides context across the entire incident management cycle and helps identify cyber risks in a timely manner
• Keep employees informed about relevant threats. The Kaspersky Automated Security Awareness Platform helps cultivate cyber-savvy behavior, including safe downloading practices
• Augment existing security controls with human-led detection and global threat intelligence through solutions like Kaspersky Managed Detection and Response (MDR), which offers 24/7 monitoring, detection, investigation and rapid response to sophisticated cyberattacks

9 ways Filipinos can secure their finances as the digital economy soars to $31 billion