What Is a DDoS Attack? How It Works and How to Stop It

A DDoS attack, distributed denial-of-service, floods a target with overwhelming traffic from many sources at once, often thousands of compromised devices, making a website or service unavailable to legitimate users. If you have wondered whether your own smart devices could already be quietly part of one, that concern is genuinely well founded.

What Is a DDoS Attack?

A DDoS, distributed denial-of-service, attack overwhelms a target server, network or service with a flood of traffic from many sources simultaneously, making it unavailable to legitimate users. A DoS attack achieves the same goal from a single source, while a DDoS attack distributes that flood across many devices at once, making it considerably harder to block by simply denying one bad address.

This distribution is precisely what makes DDoS attacks so difficult to stop. Blocking one source does nothing when the flood arrives simultaneously from thousands of devices scattered across the globe.

How Does a Botnet Launch One?

A botnet is a network of compromised, internet-connected devices, home routers, security cameras, smart TVs, all controlled remotely by an attacker without their owners’ knowledge. Each infected device becomes a small piece of a much larger attack force, and the owner rarely notices anything beyond mildly reduced performance.

An attacker infects devices, often exploiting weak default credentials or unpatched firmware, then issues a coordinated command directing every infected device to send traffic toward a single target at once. This is precisely why your own smart devices might already be part of one without your knowledge. A poorly secured router or camera on your home or office network could be quietly participating in an attack against a completely unrelated target right now, using your own internet connection’s bandwidth without your awareness.

The Four Types of DDoS Attacks

Type	What It Targets	Example Method
Volumetric	Bandwidth capacity	UDP floods, amplification
Protocol	Server resources, connection handling	SYN floods
Application-layer	Specific application logic	HTTP request floods
Multi-vector	Multiple layers simultaneously	Combining the above

Volumetric attacks aim to exhaust a target’s available bandwidth entirely, flooding it with sheer traffic volume until legitimate requests simply cannot get through. Protocol attacks target server or network equipment resources directly, exploiting how connections are established and maintained rather than raw bandwidth alone.

Application-layer attacks target the specific logic of an application itself, sending seemingly legitimate requests designed to exhaust server resources processing them, harder to distinguish from real traffic than a raw volumetric flood. Multi-vector attacks combine several of these approaches simultaneously, forcing defenders to address multiple attack types at once rather than mitigating a single, clearly identifiable pattern.

The Largest DDoS Attack Ever Recorded: And Why That Number Keeps Changing

Whatever specific figure you find cited as “the largest DDoS attack ever recorded” is likely to be outdated by the time you read it, and understanding why reveals something genuinely important about the current threat.

Here is the actual escalation, and it moves faster than almost any other security metric tracked today. Google mitigated a then-record 2.54 Tbps attack in 2017. By October 2024, Cloudflare recorded 5.6 Tbps, attributed to the emerging Aisuru botnet. By May 2025, that record climbed to 7.3 Tbps. By October 2025, Microsoft Azure mitigated 15.72 Tbps against an Australian customer, involving 3.64 billion packets per second from over 500,000 source IP addresses. By the third quarter of 2025, Cloudflare recorded 29.7 Tbps, again attributed to Aisuru, now estimated to control between one and four million infected hosts globally. Then, in December 2025, Cloudflare confirmed a 31.4 Tbps attack from an Aisuru variant called Kimwolf, lasting just 35 seconds against a telecommunications sector target.

Each of these records stood for weeks, not years. The reason is straightforward and genuinely concerning: the tools to launch these attacks have become cheap to rent, and there are more insecure, internet-connected consumer devices available to hijack into botnets than ever before. Kimwolf specifically demonstrated a novel spreading mechanism, targeting Android devices with an exposed debug interface, including devices like digital photo frames and webcams that owners assumed were safely isolated behind their home network’s protection. This means the record will almost certainly climb again before this specific figure stays accurate for long, and citing any single number as a fixed benchmark misses the more important trend: attack scale is growing because the pool of exploitable devices keeps expanding, not because attackers are becoming more sophisticated in a way defenses cannot eventually address.

HTTP/2 Rapid Reset: How a Modest Botnet Caused Record-Breaking Damage

Raw bandwidth, measured in terabits per second, is not the only metric that matters, and HTTP/2 Rapid Reset proves this precisely. In October 2023, Google disclosed mitigating an attack that peaked at 398 million requests per second, a record by an entirely different measure than the Tbps figures dominating the previous section.

This attack exploited a flaw in the HTTP/2 protocol itself, tracked as CVE-2023-44487, rather than relying primarily on an enormous number of compromised devices generating raw traffic volume. HTTP/2 allows a client to open multiple simultaneous streams within a single connection. Rapid Reset abused this by rapidly opening and immediately canceling requests, forcing a target server to do genuine processing work for each request before it could be dropped, exhausting server resources far more efficiently than simply flooding bandwidth alone ever could.

This is precisely why the attack is worth understanding separately from the sheer-scale botnets covered above. A comparatively modest number of machines, exploiting a protocol-level weakness intelligently, achieved damage on par with attacks requiring millions of infected devices generating raw traffic. This matters directly for how you think about your own defenses. A mitigation strategy built entirely around absorbing large traffic volumes may still leave you exposed to an attack that achieves similar damage through clever protocol abuse rather than brute force, meaning genuine DDoS protection needs to address both dimensions, not just the more visible, headline-grabbing Tbps figures.

What Does a DDoS Attack Cost a Business?

DDoS attacks cost businesses through direct revenue loss during downtime, particularly severe for e-commerce and any service where availability directly generates income. Recovery costs add further expense: incident response, forensic investigation, and, for businesses without existing mitigation in place, emergency deployment of protective services during an active attack.

Reputational damage compounds these direct costs, since customers experiencing an unavailable service during an attack do not necessarily know or care why it happened, only that the service was down when they needed it. For businesses relying on broadband connectivity specifically, sustained DDoS traffic exceeding even 1 Gbps directed at an internet service provider’s infrastructure has caused documented router failures affecting entire customer bases, not just the original intended target, meaning DDoS impact can spread well beyond the business initially attacked.

Who’s Behind Current DDoS Attacks Against UK Organisations?

The UK’s National Cyber Security Centre has issued current guidance specifically naming NoName057(16), a pro-Russian hacktivist group active since March 2022, as an ongoing threat to UK organizations. The group operates DDoSia, a crowdsourced platform allowing volunteers to contribute their own computing resources toward coordinated DDoS attacks in exchange for monetary rewards or community recognition, effectively turning DDoS capability into a distributed, participatory model rather than relying solely on compromised devices.

An international law enforcement effort called Operation Eastwood, coordinated by Europol and Eurojust across a dozen countries in July 2025, disrupted several hundred servers tied to the group and issued arrest warrants against multiple individuals. This should have meaningfully weakened the threat. Instead, NCSC’s own subsequent bulletin confirms the group resumed activity, since its core operators are believed to reside in Russia, entirely out of reach of the law enforcement action that successfully dismantled its supporting infrastructure elsewhere.

NCSC specifically notes the group is ideologically motivated rather than financially driven, and describes it as an evolving threat now also affecting operational technology environments, not just traditional web-facing targets. This is genuinely instructive beyond the specific group involved. A successful infrastructure takedown does not necessarily end a threat when the people directing it sit beyond the reach of the jurisdictions conducting that takedown, meaning organizations should treat this kind of law enforcement action as a genuine disruption worth acknowledging, not a resolution that removes the underlying risk entirely.

How Do You Mitigate a DDoS Attack?

Deploy a dedicated DDoS mitigation service capable of absorbing and filtering malicious traffic before it reaches your own infrastructure, since attempting to handle a large-scale attack with standard hosting infrastructure alone rarely succeeds. Anycast routing, distributing incoming traffic across multiple geographically dispersed servers, spreads an attack’s impact across a wider surface rather than concentrating it against a single point of failure.

Work with your upstream internet service provider on filtering capability specifically, since traffic that never reaches your own network cannot overwhelm it regardless of how well your own defenses are configured. Here is an honest limitation worth stating plainly: encryption protects the confidentiality and integrity of your traffic, but it does nothing to prevent a DDoS attack, since the attack targets availability specifically, overwhelming capacity rather than attempting to read or alter data in transit. Cyber Security Solutions Ltd helps businesses build genuinely layered DDoS defense combining upstream filtering, Anycast distribution and application-layer protection together, rather than relying on any single measure to address a threat that increasingly attacks multiple layers simultaneously.

Conclusion

DDoS attacks keep escalating precisely because the pool of exploitable, poorly secured devices keeps growing, and no single defense measure addresses every attack type or dimension. Start by checking whether your own connected devices use default credentials, since that gap is exactly what keeps feeding the botnets behind these record-breaking attacks. To build a genuinely layered DDoS defense for your organization, visit cybersecuritysolutionsltd.com for expert support from Cyber Security Solutions Ltd.