NETSCOUT’s latest Threat Intelligence Report reveals how distributed denial-of-service (DDoS) campaigns, fuelled by hacktivist groups, botnets, and geopolitical flashpoints, are destabilising critical infrastructure across Europe’s largest economies.
NETSCOUT recorded 8,062,971 DDoS attacks worldwide in the first half of 2025, including 3.2 million across EMEA. The report warns that DDoS attacks have evolved into precision-guided weapons of geopolitical influence capable of destabilising critical infrastructure. The most severe incidents included a 3.12 Tbps attack in the Netherlands and a 1.5 Gpps throughput attack in Germany.
As the report introduction notes: “The digital battlefield of 2025 is defined by an unprecedented escalation in DDoS warfare, with more than 8 million attacks recorded in the first half alone.”
United Kingdom: Telecoms in the Firing Line
The UK registered 101,810 attacks in 1H 2025. The largest reached 698.89 Gbps bandwidth and 187.58 Mpps throughput. Attacks lasted up to 56 minutes, highlighting greater persistence.
Most targeted UK industries:
- Wireless telecoms (including satellite): 36,500+ incidents
- Wired telecoms: 33,400+
- Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services: 7,600+
- All other telecoms: 6,800+
- Broadcasting and industrial machinery also featured prominently.
UK and Regional Trends in Context
These UK figures form part of a broader European picture in which Western Europe has become a focal point for politically motivated campaigns and record-breaking attacks.
Western Europe: Political Spillover and Record-breaking Attacks
Political Flashpoints Drive Attack Spikes
The report highlights how political milestones across Western Europe created spikes in activity. Italy is cited as a prime target during February–March 2025, while Germany experienced the largest throughput attack in EMEA at 1.5 Gpps on 25 April 2025. Techniques there included CLDAP amplification, DNS floods, and SQL amplification, overwhelming ISP backbone infrastructure.
Hacktivist Activity and Botnet Sophistication
Hacktivist groups, including NoName057(16) and Keymous+, were highly active across the region, leveraging DDoS-for-hire infrastructure to disrupt government and financial services. NETSCOUT observed: “Botnet-driven attacks dominate with increased sophistication… Attack durations increased to an average of 18 minutes and 24 seconds.” Government and industrial sectors in Germany were heavily impacted, underscoring Europe’s exposure to backbone saturation.
The report noted that major political events catalysed massive attack spikes. Italy faced sustained targeting during political discussions, and the India–Pakistan conflict saw hacktivist groups like SYLHET GANG-SG and Keymous+ target the Indian Government and financial sectors, while the Iran–Israel conflict generated more than 15,000 attacks against Iran versus 279 against Israel.”
Hacktivists and New Entrants
Europe remains a focus for both dominant and emerging hacktivist groups:
- NoName057(16) claimed “more than 475 attacks in March alone, 337% more than the next most active group.”
- DieNet orchestrated “more than 60 DDoS attacks” since March 2025, targeting US transit and Iraqi government websites.
- Keymous+ launched “73 attacks across 28 industries in 23 countries.”
Beyond the data, NETSCOUT warned of AI’s role in amplifying DDoS campaigns.
“As hacktivist groups leverage more automation, shared infrastructure, and evolving tactics, organisations must recognise that traditional defences are no longer sufficient. The integration of AI assistants and the use of large language models (LLMs), such as WormGPT and FraudGPT, escalates that concern,” said Richard Hummel, director of threat intelligence at NETSCOUT.
Hummel noted that although the recent takedown of NoName057(16) was effective in temporarily curbing the group’s DDoS botnet activities, it is not guaranteed that they won’t return as a leading threat in DDoS hacktivism. Organisations need intelligence-driven and proven DDoS defences capable of handling the sophisticated attacks that we encounter today.
Why It Matters for Enterprises
For enterprises across the UK, France, Germany and the wider European region, the implications are stark:
- Telecoms and hosting providers remain the frontline victims.
- Political instability translates into cyber spillover across Western Europe.
- AI-enabled tools are lowering barriers to entry, enabling faster, more precise campaigns.
As the report concludes, “Without comprehensive visibility into attack patterns, real-time threat intelligence, and proactive mitigation strategies, organisations remain vulnerable to attacks that not only target them directly but also create collateral damage across entire service provider networks.”
