Cybercriminals can purchase distributed denial-of-service (DDoS) attack services for as little as $1 through subscription-based offerings, while attacks arranged through intermediaries cost between $30 and $2,000, according to new research from Kaspersky Digital Footprint Intelligence.
The report examines how DDoS services are marketed and priced across the dark web, the impact of competition on the underground market, and the behavior of actors involved in providing these services. Kaspersky researchers analyzed more than 256,000 DDoS-related posts across the dark and deep web, identifying 148 actors active in this field since at least 2024.
Three Models Drive the DDoS Market
The research identifies three primary models for delivering DDoS attacks: brokered attacks commissioned through intermediaries, DDoS-as-a-Service subscriptions that provide access to attack tools through online control panels or Telegram bots, and self-managed infrastructure using custom scripts or botnets.
Pricing for brokered attacks varies according to the intended target, attack duration, service limits and available features. The study found that 65% of the monitored intermediaries promoted their services through cybercrime forums, while 35% used Telegram and Discord.
Application-Layer Attacks Dominate the Market
Kaspersky’s analysis distinguishes between network-layer attacks, which attempt to overwhelm infrastructure with large volumes of traffic, and application-layer attacks, which target websites and online services directly.
The findings show that 74% of the identified actors advertised Layer 4 (L4) techniques, including TCP, UDP and DNS floods. Meanwhile, 9% explicitly promoted standalone Layer 3 (L3) methods.
Layer 7 (L7) attacks were the most widely offered, appearing in 92% of the observed cases. According to the report, this prevalence reflects the broad availability of ready-made attack tools and the relative ease of targeting internet-facing services.
Kaspersky Warns Businesses About Low-Cost Cyberattacks
João Pedro Brandão e Silva, a Kaspersky Digital Footprint Intelligence analyst, said the low cost and easy availability of DDoS services have made these attacks a more accessible option for threat actors.
In some cases, he noted, launching an attack can cost less than a standard monthly streaming subscription or as little as a cup of coffee. He stressed that organizations should incorporate DDoS preparedness into their core cybersecurity strategies and develop a clearer understanding of the underground market behind these attacks.
Kaspersky’s Recommendations for Businesses
To strengthen protection against cyberthreats, Kaspersky recommends that organizations adopt comprehensive digital risk protection services capable of monitoring their digital assets and identifying threats across the surface, deep and dark web. One such service is Kaspersky Digital Footprint Intelligence.
The company also advises information security teams to use threat intelligence solutions that provide actionable context throughout the incident management cycle, helping them identify cyber risks promptly.
In addition, Kaspersky recommends strengthening existing security controls with expert-led detection and global threat intelligence. Its Managed Detection and Response (MDR) service provides round-the-clock monitoring, detection, investigation and rapid response to sophisticated cyberattacks.
