2025年全球DDoS攻击武器态势报告：威胁行为者的演变博弈

Actors The Evolution of DDoS The scale and techniques for DDoS attacks arerapidly evolving, with newer attacks focusing lesson sheer volume and web site disruption and more Behind all types of DDoS attacks are the “weapons” attackers use —the bots, amplifiers, and botnets. This report focuses on the sources ofDDoS attacks — providing details on the geographic and organizational with early 2025 reports of 350 percent increase in DDoS attackGlobally, attack volume continues togrow exponentiallyfrom Gbps in the early 2010s to terabits by 2024 — an increase of20X However, this breathtaking increase in the volume and frequency is lesssignificant than theincrease in sophistication and diversityof theattacks and their use against enterprise APIs3,000% increase in API attacks in 2024 compared to Today, DDoS is deeply incorporated into cybercriminals portfoliofor combined attacks against APIs and web sites, and can includeransomware, credential stuffing or used as a distraction from other DDoS attacks pose significant direct coststo enterprise, estimated from $50,000 to overper incident as well as significant long-term$400,000 This report uses data collected by the A10 threat research team througha combination of internet scanning, patented deception techniques, andopen-source intelligence and provides a snapshot of a constantly changing The total number of DDoS weapons tracked by A10 has remainedwithin a20% range, over the last four reports. This 2025 sample is the Key Findings 12.3M1.5M61%24%22%71%ItalyUSChina75% This year,China edged out the USwith total weapons at 1.5 millionvs 1.4 million, due to high numbers of amplification weapons. India led all other countries as a source for bots, providing 61% ofglobal bots in our sample. China comes in second, contributing 18% Together,China and the US comprise 24%of the global amplifier Once againSSDP remains the largest amplification category, The top six protocol categories contribute71% of tracked amplifiers,with the remainder distributed amongst twenty-four other categories. On a population basis,Italy hosts the highest concentration ofweapons, followed by South Korea — 3X more than the US. On a population basis, theUS has four times more weapons(perM Population) than China. While US has twice as many connected devices per capita as China,China has more than twicethe total number of connected devices. 75% of bots sampled are hosted infive Asian organizations(by ASN). DDoS Attack Vectors Malicious actors can use any combination of weaponsidentified in this report to launch DDoS attacks againstany organization — enterprise, telecom service provider,data center provider, cloud service provider. There are Huge volumetric attacks attract the most media headlines. In volumetricattacks, large volumes of traffic flood internet networks with junk traffic,thereby preventing legitimate users from getting through. These attacks handshake that is used to establish a TCP connection between internet users Application layer attacks exploit logic flaws in the victim’s apps. A DDoS attacktargeting the application layer is sophisticated and subtle, not a brute forceassault that relies on massive data flows to take down its victim. The objectiveis to exhaust the victim’s resources at the application layer (e.g., web servers,HTTP servers, DNS services, and APIs). Attackers send complex requests Network protocol attacks exploit weaknesses in protocols that enable webbrowsing, streaming, file transfers, and the overall movement of data across Total DDoS Weapons While the volume of DDoS attacks has increasedexponentially, the number of DDoS weapons has This suggests that the growth of DDoS attacks is more related to the growingsophistication of the attackers, rather than the absolute increase in potentialweapons. Still, there are millions of weapons available to attackers. The In 2025, the A10 sample identified12.3 millionDDoS Weapons, including12.2 million Attackers use diverse attack vectors and multiple protocols,leveragingweapons hosted all over the world. For example, a 6.5 Tbps attack, thelargest attack reported so far, occurred in April 2025 and used over 30,000 The next section of this report providesdetails on the sources(regions, Sources of DDoS Weaponry DDoS attacks can originate from anywhere, but in thepast few years of A10 tracking, Asia has consistentlyhosted the largest numbers of DDoS weapons — bothamplifiers and bots. In 2025, Asia (including China and DDOS WEAPONS BY COUNTRY Eight countries shown in Figure 03 providehalf of the global DDoS weapons, withChina and the US hosting almost a quarterof those. In the 2025 sample,China edged WEAPONS CONCENTRATION BY COUNTRY The total volume of weapons in each country is closely related to the totalquantity ofvulnerable internet-connected devices and population.China and the U.S. have been the largest sources for all years tracked due to the substantial number of IoT devices. However, when v