Botnet Takedowns Are Working — But DDoS Operators Are Already Adapting
Brief
Every time a major botnet is dismantled, the cybersecurity community celebrates—and rightly so. These operations are technically complex, require international cooperation, and make life considerably harder for cybercriminals.
The problem is that their success is often measured by what disappears rather than by the threat that remains.
Recent observations from Q2 2026 illustrate why that distinction matters.
For more than two years, every new record seemed to eclipse the last. The largest botnets we observed grew from 136,000 devices in 2023 to 228,000 in 2024, then to 5. 76 million in 2025, and finally to a record 13. 5 million devices in Q1 2026. Then, for the first time, the trend reversed. In Q2, the largest botnet we observed consisted of just 2. 09 million devices.