Kaspersky Digital Footprint Intelligence (DFI) says brokered DDoS attacks on the darknet are offered for between $30 and $2,000, while some DDoS-as-a-Service subscriptions are available for as little as $1. The company’s research describes a market where darknet DDoS attack pricing changes according to the target, attack duration, service limits and available features.
The findings come from an analysis of more than 256,000 DDoS-related posts across the dark and deep web. Kaspersky DFI experts identified 148 DDoS actors active since at least 2024 and examined how services are offered, priced and marketed. The research also considered how competition shapes the market over time and the behavioral patterns associated with actors involved in the DDoS supply.
Three service models
Kaspersky identifies three main DDoS attack models. In brokered attacks, a third party is hired to conduct the attack. DDoS-as-a-Service allows users to subscribe to attack tools, including online control panels or Telegram bots. In-house infrastructure involves actors operating their own attack scripts or botnets.
Among the brokered actors observed by Kaspersky, 65% advertised on cybercriminal forums, while 35% used Telegram and Discord. The source records these channels as places where the observed brokered actors advertised.
The research also distinguishes between network-layer and application-layer attacks. Network-layer attacks seek to overwhelm infrastructure with heavy traffic, while application-layer attacks aim to disrupt websites and online services directly.
Kaspersky DFI says 74% of the actors it analyzed advertised L4 techniques, including TCP, UDP and DNS floods. Only 9% explicitly referred to standalone L3 methods. L7 attacks appeared in 92% of cases, making them the most widely offered category in the company’s analysis.
Why the pricing matters
Kaspersky analyst João Pedro Brandão e Silva linked darknet DDoS attack pricing to services that are cheap and easy to obtain. “In some cases, the cost of launching an attack can be lower than a standard monthly streaming subscription, or even for a price of a cup of coffee,” he said.
For businesses, the analyst said DDoS readiness should form part of basic cybersecurity planning. He also said understanding the market behind the attacks is important because stronger defense begins with a clearer view of the threat environment. The research places darknet DDoS attack pricing alongside subscription tools such as online control panels and Telegram bots, as well as in-house attack scripts or botnets.
Kaspersky’s recommendations include adopting a digital risk protection service that monitors an organization’s digital assets across the surface, deep and dark web. The company also recommends giving InfoSec professionals visibility into cyberthreats, keeping employees informed about relevant threats and augmenting existing controls with human-led detection and global threat intelligence.
Its listed offerings include Kaspersky Digital Footprint Intelligence, Kaspersky Threat Intelligence, Kaspersky Automated Security Awareness Platform and Kaspersky Managed Detection and Response (MDR). Kaspersky says MDR provides 24/7 monitoring, detection, investigation and rapid response to sophisticated cyberattacks.
Kaspersky, founded in 1997, describes itself as a global cybersecurity and digital privacy company. It says it safeguards consumers, businesses, critical infrastructure and governments from cyberthreats, with over a billion devices protected to date. The company says it is trusted by nearly 200,000 organizations. The full report is identified in the release as available through Kaspersky.
