dotdailydose
Kaspersky Digital Footprint Intelligence experts found that DDoS-related promotion increasingly relies on dashboard monitoring systems that serve as both measurement tools and public storefronts. Through a website or Telegram bot, a participant can choose infrastructure and attack methods, launch an attack and receive a score based on metrics such as requests per second or throughput in Gbps. The result is then added to a public leaderboard, allowing actors to compare performance and showcase their capabilities in the same interface. Kaspersky researchers observed that these systems do more than measure output – they turn visibility into part of the cybercriminals’ product. In some communities, rankings evolve into long-term competitions, with prizes offered to actors who hold the top position for six consecutive months. This makes operational telemetry a reputational asset and a built-in promotional channel.
“For defenders, the challenge goes beyond attack volume to the growing commercialization and visibility of offensive capabilities,” said João Pedro Brandão e Silva, Kaspersky Digital Footprint Intelligence analyst. “What is particularly striking is how closely this ecosystem now resembles a conventional industry: DDoS actors are competing for customers, differentiating their services, and using public leaderboards and performance dashboards to prove results.”
Kaspersky also found that this commercial logic often extends beyond DDoS itself. In the analyzed dataset, 43% of DDoS providers who advertised on cybercriminal forums also promoted side services. These fell into two broad categories: asset reuse, including infrastructure, malware and attack tools repurposed for adjacent services, and knowledge reuse, where operators monetized their experience through defensive offerings, consulting, or training. Some of these services remained closely linked to DDoS activity, such as script sales, VPS rental and anti-DDoS services. Others applied the same infrastructure and operating model to adjacent abuse, including spam campaigns, mass reporting and takedown-related claims. Kaspersky’s DFI experts’ findings suggest that, for many providers, DDoS is part of a broader service portfolio rather than a standalone offering.
The toolkit does not end there as Kaspersky researchers also revealed that to stay competitive, resource providers are increasingly relying on proprietary DDoS methods rather than public tools, using custom capabilities to deliver stronger attacks and improve their chances of bypassing anti-DDoS defenses.
These capabilities include traffic amplification, advanced request handling and evasion techniques designed to mimic legitimate traffic. Notably, 33% of actors explicitly claimed they could bypass anti-DDoS protections, referencing 32 vendors across L4, L7 and game server protection.
For more details read the full report by link.
To strengthen the protection of your business, Kaspersky recommends the following:
- Adopt a comprehensive digital risk protection service that monitors organizations’ digital assets and detects threats across the surface, deep and dark web such as Kaspersky Digital Footprint Intelligence.
- Provide your InfoSec professionals with an in-depth visibility into cyberthreats targeting your organization. The latest Kaspersky Threat Intelligence provides them with rich and meaningful context across the entire incident management cycle and helps them identify cyber risks in a timely manner.
- Keep your employees informed about relevant threats. Kaspersky Automated Security Awareness Platform helps cultivate cyber-savvy behavior, including safe downloading practices.
- Augment existing security controls with human-led detection and global threat intelligence through solutions like Kaspersky Managed Detection and Response (MDR), which offers 24/7 monitoring, detection, investigation and rapid response to sophisticated cyberattacks.
