Kaspersky Counts 148 DDoS Services — and the Hacktivists Are Now Customers
Kaspersky's Digital Footprint Intelligence team has published a study of the DDoS economy built on more than 256,000 advertisements and posts harvested from the darknet and the deep web. From that noise they isolated 148 active DDoS service providers — and found that nine of them maintain working relationships with hacktivist groups. At least four of those groups now ship their own attack tools instead of only renting someone else's. For anyone who has watched this market from the inside, that is less a revelation than a receipt: the volunteers and the vendors have finally merged into a single supply chain.
Storefronts, reviews and a public leaderboard
The report maps four distinct promotion channels. Aggregators act as catalogues, ranking providers by specifications and customer reviews. Bulk advertising in messengers does the volume work. Shadow forums supply the trust layer, complete with reputation scores and anti-scam checks. The newest addition is the rating platform: it benchmarks a candidate's attack against a designated target, measures the resulting throughput, and writes the operator into a public table. That is a load-test harness with a marketing department bolted on — measure the number, publish the number, let the number sell the subscription.
It is the same machinery any marketplace needs to function: escrow, reviews, dispute handling, verified sellers. The only difference is that the product being rated is measured in packets per second.
What a DDoS service costs in 2026
Pricing has settled into recognisable tiers. At the bottom, a booter or ip stresser panel sells a few minutes of layer 4 for the price of a coffee — SYN flood, ACK flood, UDP flood, occasionally UDP amplification through DNS, NTP, SSDP or CLDAP reflectors. Mid-range subscriptions add layer 7: HTTP GET flood, HTTP POST flood, Slowloris, TLS flood, connection flood and the perennial HTTP/2 Rapid Reset. The premium tier is where the margin lives — browser emulation, headless browser fleets, JS challenge bypass, JA3 and HTTP/2 fingerprint rotation, user-agent rotation. That is the toolkit that turns a Cloudflare bypass from a research paper into an invoice line.
Billing comes in per-attack, hourly, monthly and "unlimited" flavours, the last of which is unlimited until it very much is not. Resellers buy at wholesale, which is precisely how a hacktivist group ends up as both a customer and a distributor of the same DDoS-for-hire platform. The same panels are cheerfully marketed to developers as stress testing tools; the interface does not care whether you are validating a cluster or settling a grudge.
Cheap entry, expensive consequences
White-label panels, crypto-only checkout, no KYC and affiliate payouts have collapsed the cost of going into business. A group with an audience and no infrastructure can rent capacity, resell it and keep the spread. Providers get something more valuable than the resale margin: public proof. When a hacktivist campaign knocks a target offline, the vendor reposts the result as a case study, and the next customer arrives pre-sold. Attack volumes climb because the marginal cost of one more flood is close to zero while its promotional value is not.
Nine of the 148 providers were already tied to hacktivist crews, and the next step writes itself: those crews become the reseller tier, bringing an audience, a target list and a plausible cause to a business that previously sold only bandwidth. For defenders the timeline compresses accordingly. A fresh CVE goes from disclosure to a feature in somebody's panel in days, and the botnet capacity that once required a bespoke build is now a line item anyone can rent. That is why DDoS protection has to be validated against real traffic rather than a vendor's slide deck.
Prove it on your own infrastructure
Kaspersky's 148 DDoS service providers will keep advertising, the leaderboards will keep updating, and the boundary between ideology and invoice will keep thinning. The only honest way to find out whether your scrubbing, anycast routing and rate limits actually hold is to point a real attack at them and watch. Our free stress test at /contact does exactly that — no sales call, no slide deck, just traffic and a report.