New Kaspersky Digital Footprint Intelligence research shows hacktivist groups seem to be using DDoS-for-hire services: among 148 actors analysed, 9 showed hacktivist ties, pointing to closer links between ideological campaigns and commercial attack providers.
Kaspersky Digital Footprint Intelligence research into the DDoS offerings market found that some hacktivist groups are aligning with DDoS providers to expand their attack capabilities, while the providers use public campaign activity to increase visibility for their services. In observed cases, attacks were announced publicly, their results were shared through affiliated channels. Such approach might allow providers to benefit from being linked to active operations, as it shows real cybercrime results to the potential darknet clients. At least four active hacktivist groups were also observed promoting self-made DDoS tools, suggesting that the current landscape includes both groups that build their own infrastructure and groups that rely on outside providers.
Example of an alliance statement between hacktivists and a stresser service.
The research found that the DDoS providers compete for attention through a multi-layered advertising ecosystem that includes DDoS aggregators, messaging platforms and cybercriminal forums. Aggregator sites function as searchable catalogs that rank providers by claimed features, trust signals or “user feedback”. Messaging channels are used for repeated promotional posts, sometimes through dedicated advertising threads. While such channels develop, old-school cybercriminal forums remain a stable venue for promotion: on such platforms reputation systems can strengthen credibility among the potential clients and even support anti-scammer checks.
Among different channels of offerings distribution, Kaspersky DFI researchers also identified leaderboard-style platforms as a newer promotional mechanism designed to turn visibility into a competitive asset.
Example of
telemetry from an attack monitored by a leaderboard site.
“DDoS darknet market now operates much like a mainstream online market, competing for attention with basically familiar advertising instruments. That structure gives cybercriminals more ways to stay visible and reach potential customers. For defenders, understanding how this ecosystem markets itself helps identify emerging actors earlier, prioritise monitoring of the particular channels and better anticipate how attack activity may spread,” says Kseniya Kudasheva, Kaspersky Digital Footprint Intelligence analyst.
The broader DDoS offering market can be classified as a growing one: 16 new actors were identified in the first quarter of 2026 alone, – if that pace continues, the number of new entrants in 2026 could exceed the 2025 total by at least 25%. Despite the influx of new actors, the market remains volatile: across the analysed actors, the average observed lifetime was about 2.5 years, measured from the first to the last advertisement of DDoS capabilities. At the same time, the oldest still-active providers marked 10 years of operation last year, indicating that short-lived services coexist with more established operators. The experts link this growth to several factors, including the broader use of DDoS attacks, more frequent campaigns tied to geopolitical tensions and the availability of open-source stresser tools that lower the barrier to entry.
To strengthen the protection of your business, Kaspersky recommends the following:
- Adopt a comprehensive digital risk protection service that monitors organisations' digital assets and detects threats across the surface, deep and dark web such as Kaspersky Digital Footprint Intelligence.
- Provide your InfoSec professionals with an in-depth visibility into cyberthreats targeting your organization. The latest Kaspersky Threat Intelligence provides them with rich and meaningful context across the entire incident management cycle and helps them identify cyber risks in a timely manner.
- Keep your employees informed about relevant threats. Kaspersky Automated Security Awareness Platform helps cultivate cyber-savvy behaviour, including safe downloading practices.
- Augment existing security controls with human-led detection and global threat intelligence through solutions like Kaspersky Managed Detection and Response (MDR), which offers 24/7 monitoring, detection, investigation and rapid response to sophisticated cyberattacks.
For more details read the full report by link.
