Kaspersky Digital Footprint Intelligence research shows that ideological groups are increasingly coordinating with DDoS attack providers to execute digital disruptions. Among 148 threat actors analyzed by researchers, nine demonstrated clear hacktivist ties. This development indicates closer ties between political campaigns and commercial attack services across the global cybersecurity environment.
Under these cooperative arrangements, hacktivist collectives contract outside services to expand their operational scale. In turn, commercial services use the high visibility of public operations to advertise their technical capabilities. Attacks are routinely announced in public forums, with verified disruption metrics published to attract buyers on darknet markets.
Tactics Used by DDoS Attack Providers
Commercial DDoS attack providers rely on a multi-tiered promotional system to secure market share. The study found that operators maintain presence across dedicated aggregator websites, encrypted messaging channels, and conventional cybercrime message boards. Aggregators operate as searchable product catalogs where providers are ranked by claimed technical capacity, reliability signals, and customer feedback.
While modern messaging platforms host continuous promotional threads, established cybercrime forums remain central to the trade. These forums offer reputation systems and formal anti-scam procedures that validate supplier credibility for prospective clients.
Promotional Leaderboards and Underground Telemetry
Researchers identified leaderboard platforms as an emerging mechanism designed to turn public attention into operational advantage. These portals track live operational metrics and highlight successful disruptions, functioning as competitive scoreboards for rival services.
Alongside commercial outsourcing, the report noted that at least four active hacktivist groups developed and promoted proprietary attack tools. Consequently, the threat environment contains both self-reliant technical units and entities dependent on outside infrastructure.
“DDoS darknet market now operates much like a mainstream online market, competing for attention with basically familiar advertising instruments. That structure gives cybercriminals more ways to stay visible and reach potential customers. For defenders, understanding how this ecosystem markets itself helps identify emerging actors earlier, prioritize monitoring of the particular channels and better anticipate how attack activity may spread,”
Kseniya Kudasheva, Kaspersky Digital Footprint Intelligence analyst
Market Expansion and Rapid Turnover
The underlying infrastructure market continues to expand at a steady pace. Security specialists tracked 16 new commercial entrants during the first quarter of 2026. Furthermore, if this operational trajectory persists, the volume of new suppliers entering the economy of cybercrime in 2026 will exceed 2025 levels by at least 25%.
Despite this influx, individual operations experience significant volatility. The average observed lifespan of suppliers was approximately 2.5 years from their initial listing to dissolution. However, established entities endure; the oldest monitored providers completed a decade of continuous activity last year.
Drivers Behind Commercial Growth
Security analysts attribute the ongoing expansion to geopolitical conflicts and the wide availability of open-source stresser scripts. These accessible tools lower entry requirements for prospective operators, which facilitates rapid technical deployment across distributed networks.
To mitigate these systemic threats, organizations should use risk intelligence services that monitor network threats across surface, deep, and dark web environments. In addition, enterprise defensive teams require contextual threat intelligence and automated training to recognize digital vectors before intrusions disrupt core operational infrastructure.
