Research identifies commercial attack services increasingly supporting ideological campaigns, while providers use public hacktivist operations to promote their offerings.
Hacktivist groups are increasingly connecting with commercial distributed denial-of-service (DDoS) providers to expand their attack capabilities, according to new research by Kaspersky Digital Footprint Intelligence. The study, which analysed 148 actors in the DDoS market, identified nine with links to hacktivist activity, highlighting closer ties between politically or ideologically motivated campaigns and cybercrime service providers.
Kaspersky found that some providers are aligning themselves with hacktivist groups, while using the visibility generated by public attack campaigns to market their services. In observed cases, attacks were announced publicly and their results circulated through affiliated channels, potentially demonstrating providers’ capabilities to prospective customers on the dark web.
The research also identified at least four active hacktivist groups promoting their own DDoS tools, indicating that the ecosystem comprises both groups operating independent infrastructure and those relying on external services.
“DDoS darknet market now operates much like a mainstream online market, competing for attention with basically familiar advertising instruments.”
— Kseniya Kudasheva, Digital Footprint Intelligence Analyst, Kaspersky
DDoS services adopt organised marketing tactics
The DDoS-for-hire market is developing a multi-channel promotional ecosystem. Providers compete for customers through aggregator websites, messaging platforms and cybercriminal forums. Aggregators operate as searchable catalogues, ranking services according to advertised capabilities, reputation indicators and user feedback. Messaging channels carry repeated promotional campaigns, while underground forums offer reputation systems that can help establish credibility.
Kaspersky also identified leaderboard-style platforms as an emerging promotional mechanism, turning attack visibility and performance claims into competitive marketing tools.
“Understanding how this ecosystem markets itself helps identify emerging actors earlier, prioritise monitoring of particular channels and better anticipate how attack activity may spread,” said Kseniya Kudasheva, Kaspersky Digital Footprint Intelligence analyst.
Market growth brings new and established players
The research identified 16 new DDoS actors in the first quarter of 2026. If this pace continues, new entrants could exceed the 2025 total by at least 25%. However, the market remains volatile: the average observed lifetime of analysed actors was approximately 2.5 years, based on their first and last advertisements. Some established providers, meanwhile, have operated for a decade.
Kaspersky attributes market growth to wider DDoS adoption, geopolitical tensions driving attack campaigns and the availability of open-source stresser tools that lower the entry barrier.
To counter these threats, the company recommends continuous monitoring of the surface, deep and dark web; access to actionable threat intelligence; employee security awareness; and managed detection and response services with round-the-clock monitoring and investigation.
The findings underline how DDoS activity is evolving beyond isolated attacks into a commercially supported ecosystem, making visibility into threat actors, their promotional channels and operational relationships increasingly important for defenders.
