Protecting the Internet from AI-enabled threats

Every year, data from our #1 ranked global backbone provides us with actionable defense insights straight from the heart of the Internet. Our annual threat landscape report has proven invaluable for helping our customers prepare for constantly evolving Distributed-Denial-of-Service (DDoS) attacks.

This year was no different, as we saw record-breaking botnet attacks reaching 6.1 Terabits per second (Tbps), pushing into hypervolumetric territory. Arelion’s high-capacity backbone, backed by our DDoS Mitigation services, has remained resilient despite these escalating attack sizes, demonstrating how automation and scale work together to protect our customers’ networks.

Our report covers everything from overall network impacts and the evolution of attack vectors to how geopolitical events influence cyber warfare. Let’s look closer to see how the threat landscape has evolved from 2025 to 2026, and how our backbone is designed with network-level defenses that keep our customers secure and operational, even as AI lowers the barrier to entry for launching large DDoS attacks.

The mother of all botnets

Aisuru dominated headlines throughout the past year, emerging as the most destructive DDoS threat of 2025. This “mother of all botnets” harnessed more than 500,000 compromised Internet-of-Things (IoT) devices and Android-based systems to execute record-breaking attacks, peaking in December 2025 at 31.4 Tbps.

A single botnet has reshaped the threat landscape, with home networks becoming distributed launch pads for large DDoS attacks. Despite hundreds of daily attacks from Aisuru, Arelion’s backbone absorbed the malicious traffic with minimal customer disruption, demonstrating the value of network-level mitigation at scale.

Enterprises should take note: capacity matters more than ever before because they can no longer assume traditional on-premises defenses will withstand multi-terabit attacks. This shift reinforces why enterprises need DDoS mitigation backed by high-capacity infrastructure.

Gaming and video platforms under attack

Major gaming and video platforms were primary targets, with high-volume campaigns (primarily launched by Aisuru) exceeding 1 Tbps on a daily basis. In one customer example, a major online gaming platform sustained multi-vector attacks, peaking at several Tbps.

Our network-based mitigation (including Border Gateway Protocol (BGP) Flowspec, an automated defense mechanism) filtered malicious traffic while preserving legitimate sessions, helping our customers maintain business continuity and minimize disruption to players, even during peak hours.

While gaming platforms experienced some of the largest attacks, the same techniques increasingly threaten financial services, SaaS platforms, AI applications and other latency-sensitive digital services where downtime has immediate business consequences. Our high-capacity DDoS Mitigation solution allows customers across these industries to scale to the number of managed objects and support their growing defense needs despite this onslaught.

Current trends reflect how terabit-scale attacks have become the new baseline, as many attackers trade sophistication for brute force to overwhelm network defenses. For enterprises, this means designing around yesterday’s threat models is no longer sufficient. It’s now clear that the scale and automation underpinning our defenses are critical to effective mitigation.

DDoS Mitigation with superior precision

Amid these escalating attack sizes, our DDoS Mitigation services apply highly targeted traffic scrubbing techniques and host-level protection to automatically detect and mitigate threats.

This network-based mitigation provides a powerful shield against DDoS attack traffic, ensuring that only legitimate traffic passes through and that malicious traffic is dropped within our global backbone network before it ever reaches our customers’ Internet connections.

Our partnership with NETSCOUT significantly increases the density of network monitoring across our global Internet backbone, providing better protection for enterprises’ high-bandwidth applications. It also enables more granular visibility of traffic patterns, facilitating faster anomaly detection and speedier threat responses.

Through our SecureConnect solution, we bundle DDoS Mitigation into our global connectivity services, including IP Transit and Dedicated Internet Access (DIA), providing customers with integrated volumetric protection that establishes a cost-effective, powerful defense against DDoS attacks.

This solution enhances flexibility and resilience to safeguard the network underlay, reflecting our longstanding commitment to providing reliable connectivity that is crucial to global economies. As DDoS attacks grow in scale and frequency, enterprises need mitigation that scales alongside their networks rather than becoming another infrastructure bottleneck.

Visit our DDoS Mitigation product page or contact us today to learn how our services can help you safeguard your network operations, even if you come into the crosshairs of a record-breaking DDoS attack.

David Young, Product Manager IP and Security