91% Of UAE Ddos Attacks Are Low-Volume As Threats Turn Stealthier

(MENAFN- Khaleej Times) UAE organisations are facing a fundamental shift in the nature of cyberattacks, with the vast majority of distributed denial-of-service (DDoS) incidents now designed to be harder to detect rather than simply bigger in scale. According to cybersecurity firm Help AG, 91 per cent of the 236,560 DDoS attacks it observed during the first half of 2026 were classified as low-volume, highlighting a move towards stealthier and more persistent campaigns.

The findings suggest attackers are increasingly prioritising precision over brute force, targeting the underlying resources that keep digital services running rather than overwhelming networks with large traffic volumes. As a result, businesses are experiencing performance degradation, service instability and operational disruption even when attack traffic appears relatively low.

Recommended For You

Stay up to date with the latest news. Follow KT on WhatsApp Channels.

“The future of DDoS is not defined by volume, but by precision,” said Gaurav Srivastava, Director of Managed Security Controls at Help AG, the cybersecurity arm of e&.“As attacks become more distributed, persistent and adaptive, organisations are being challenged not only to keep services online, but to maintain performance, availability and user trust under pressure.”

One of the clearest indicators of this trend is the increasing duration of attacks. Help AG recorded the longest DDoS campaign lasting 58 days and 23 hours during the first six months of the year, underscoring the growing use of persistent attacks aimed at gradually exhausting resources rather than triggering immediate outages.

Such attacks often remain below traditional detection thresholds or mimic legitimate traffic, leading to intermittent latency, connection failures and resource exhaustion that can be difficult for security teams to identify quickly. Help AG warned that organisations need to focus not only on attack intensity but also on duration when assessing cyber risks.

At the same time, attackers are increasingly combining different techniques to maximise disruption. Help AG found that 70 per cent of DDoS incidents in H1 2026 employed multiple attack vectors, targeting networks, applications and APIs either simultaneously or sequentially.

“Stopping one form of attack does not necessarily mean the service is protected,” Srivastava said.“Disruption can simply move elsewhere, from firewalls and load balancers to applications, APIs or the resources behind them.”

The rise of so-called“carpet bombing” attacks is adding another layer of complexity. Rather than concentrating malicious traffic on a single target, attackers distribute traffic across multiple IP addresses within a network range. Each individual attack may appear insignificant, but collectively they can place considerable strain on shared infrastructure and network capacity.

Artificial intelligence is also accelerating the pace at which attackers operate. While fully autonomous cyberattacks remain limited, AI-assisted tools are increasingly being used to automate reconnaissance, identify targets, generate attack variations and analyse defensive responses. According to Help AG, this shortens the cycle between reconnaissance, attack and adaptation, leaving defenders with less time to react.

“AI is accelerating the speed at which attackers can identify opportunities, adapt techniques and refine campaigns,” Srivastava said.“As that cycle accelerates, defenders have a smaller window to recognise and respond to change.”

To counter these evolving threats, cybersecurity strategies in the UAE are moving towards continuous monitoring, behavioural analysis and integrated protection spanning networks, cloud environments, applications and APIs. Help AG argues that resilience can no longer be measured solely by whether services remain online, but by their ability to sustain performance and availability throughout prolonged attacks.

“The future of DDoS resilience is not about surviving the biggest attack,” Srivastava said.“It is about maintaining performance, availability and trust as pressure moves across the entire digital service.”

ALSO READ

UAE smart homes, IoT devices, cars targeted amid attack surge, says cybersecurity chief UAE energy, aviation sectors key target for cyberattacks, official says

MENAFN22092026000049011007ID1111699702