DDoS Attacks Hit 31.4 Tbps Record: AI Botnets Turn Defense Into an Arms Race

If you think DDoS attacks are just an occasional nuisance that slows down websites, the numbers might change your mind. According to Gcore's data, 47.1 million DDoS attacks hit the global internet in 2025—averaging about 1.5 attacks per second. Meanwhile, Cloudflare alone blocked 20.5 million DDoS attacks in Q1 2025, a figure representing 96% of their entire 2024 total.

This isn't random traffic fluctuation. DDoS has become the internet's "background radiation"—constantly present, steadily intensifying, and increasingly difficult to defend against.

31.4 Tbps: When Attack Scale Defies Human Intuition

The largest recorded DDoS attack so far reached 31.4 Tbps, sustained for just 35 seconds. The number sounds abstract, but put it this way—it's roughly equivalent to every household broadband connection in the world sending data simultaneously to a single server, non-stop.

The growth curve behind this is even more unsettling: just 14 months ago, the record stood at 3.8 Tbps. That means attack scale grew 726% in a year and a half—and the primary driver of this exponential surge is AI.

How AI Is "Leveling Up" Attacks

In a Network World interview, Carlos Morales, SVP of Arbor Cloud at NETSCOUT, highlighted three critical shifts:

• No more amplification tricks: Older botnets relied on DNS/NTP reflection and traffic amplification to disguise attacks as legitimate third-party traffic. Today's AI-expanded botnets are large enough to generate raw attack volume directly from compromised devices—cleaner, more direct, and harder to trace.
• AI takes over attack coordination: Reconnaissance, vector switching, target selection—work that once required human hackers in real-time is now fully automated. A single botnet can even "self-evolve," switching attack vectors the moment one approach gets detected.
• Stateful attacks replace stateless floods: This is the deadliest shift. Traditional reflection attacks are stateless—forged packets need no connection handshake, making them filterable at the firewall. But AI-coordinated botnets maintain real TCP sessions, using large numbers of genuinely compromised devices to send requests that appear perfectly legitimate. This traffic often lands on legitimate service ports where simple ACLs can't block it without also blocking real users.

What Are Defenders Doing? Is 33 Tbps Enough?

NETSCOUT recently announced doubling its Arbor Cloud DDoS mitigation capacity from 15 Tbps to 33 Tbps, distributed across 16 global scrubbing centers. This expansion partly comes from acquiring DigiCert's DDoS and WAF services in May this year.

But NETSCOUT itself admits this isn't the endgame—Morales stated "this won't be a one-time buildout, there will likely be more bandwidth upgrades ahead." Translated: attackers' budgets always outpace defenders'.

The SMB Reality: $22,000 Per Minute of Downtime

MazeBolt's statistics show that each minute of DDoS downtime costs an average of $22,000 (roughly $1.32 million per hour). The irony? Renting a DDoS-for-hire service costs as little as $38 per hour. Attackers can cost your business over $22K per minute for less than a cup of coffee—the attacker-to-defender cost ratio is a staggering 1:3158.

For budget-constrained SMEs and startups, building 30+ Tbps defense infrastructure in-house is obviously unrealistic. Cloud-based protection becomes the only viable path, but that also means handing your lifeline to a third party—when attacks outscale their capacity, who catches you?

AI Is Not Just Part of the Problem—It's the Answer

NETSCOUT's strategy is clear: counter AI-powered attacks with automation and speed. "You can't rely on human speed, but you can rely on human judgment. Let technology handle speed and response," Morales said.

This means future DDoS defense will increasingly depend on AI-driven analytics engines—making filtering decisions in milliseconds as attacks unfold, while maintaining enough intelligence to distinguish genuine user traffic from malicious requests. For websites and services requiring round-the-clock protection, this "AI vs AI" paradigm is no longer optional—it's essential.