A novel, fragmented DDoS campaign employed a sophisticated "low and slow" attack vector, distributing 2.45 billion requests across over 1.2 million unique IPs with a pulsed cadence averaging one request every nine seconds per IP to evade traditional rate-limiting and IP blocking defenses. The campaign was detected through behavioral analysis of inconsistent TLS handshakes and browser signals, not by static volume thresholds. This highlights a critical shift requiring security teams to adopt detection models that analyze traffic behavior over time rather than relying on conventional DDoS mitigation techniques.
Security Operations , Network Security , Threat Intelligence Fragmented DDoS campaign bypasses defenses with novel ‘low and slow’ approach May 8, 2026 Share By SC Staff (Adobe Stock) A new report details one of the most fragmented DDoS campaigns ever recorded, where cybercriminals launched 2.45 billion malicious requests in five hours at a major user-generated content platform. This research reflects a concerning change in how threat actors are now bypassing traditional security, opting for a sophisticated "low and slow" approach instead of brute force, with further coverage provided by HackRead. The attack, identified by DataDome's Galileo threat research team, utilized a vast infrastructure, distributing traffic across over 1.2 million unique IP addresses and 16,402 distinct Autonomous Systems (ASNs). No single network accounted for more than 3% of the total volume, making traditional IP blocking ineffective. The attackers employed a "pulsed cadence" strategy, averaging roughly one request every nine seconds per IP address, which stayed below standard rate-limiting thresholds. Despite attempts to forge HTTP headers, cookies, and TLS fingerprints, the campaign was detected through behavioral analysis due to inconsistent TLS handshakes and unstable browser identification signals. This managed operation highlights the need for security teams to adopt detection models that analyze traffic behavior over time, rather than relying solely on static volume limits. Source: HackRead An In-Depth Guide to Network Security Get essential knowledge and practical strategies to fortify your network security. Learn More SC Staff Related Security Operations Tanium and ServiceNow partner for autonomous IT operations SC Staff May 8, 2026 The collaboration merges Tanium's real-time endpoint intelligence with ServiceNow's workflow orchestration to address the gap between IT visibility and action. Phishing Herd Security raises $3 million for AI-powered security training SC Staff May 8, 2026 Founded in 2025, Herd Security provides an agentic AI platform designed for continuous security awareness training. Security Operations Boost Security acquires 2 startups, raises $4 million for AI defense platform SC Staff May 8, 2026 Boost Security has acquired SecureIQx, an MIT-founded startup specializing in software composition analysis reachability, and Korbit Technologies, an AI-driven pull request review platform. Related Events Cybercast AI for better SecOps: A Black Hat preview Tue Jul 7 Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms DNS Spoofing Deepfake Denial of Service Dictionary Attack Disaster Recovery Plan (DRP) Disruption Domain Name Domain Name System (DNS) Dynamic Routing Protocol Google Hacking You can skip this ad in 5 seconds