A DDoS attack can be ordered for $30–2000, while a monthly subscription to cyberattack services can cost up to $30,000. These figures were obtained by specialists at Kaspersky Digital Footprint Intelligence after analysing more than 250,000 posts on the darknet and deep web.
HOW THE DDOS SERVICES MARKET DEVELOPED
According to Kaspersky Digital Footprint Intelligence, which studied shadow offerings, there are almost 150 DDoS service providers operating on the market. The company presented the findings of its research at the KazHackStan 2026 conference, BES.media reports.
The cost of a one-off attack depends on its power, duration and the chosen target. Services lasting from one to 30 days are offered for $30–2000. Some sellers offer trial attacks for around $10, while certain ones allow you to test their capabilities for free.
HOW THE SERVICES WORK
Analysts identify three main models: one-off attacks to order, subscriptions to specialised services, and the use of one's own infrastructure.
A subscription usually lasts 30 days. The customer gets the ability to launch attacks lasting from one minute to 48 hours. The price ranges from $1,000 to $30,000 per month and depends on the power, duration and number of simultaneous attacks.
THE NUMBER OF PROVIDERS IS GROWING
According to the research, DDoS service providers operate on the shadow market for an average of around 2.5 years, and some remain active for almost 10 years.
Since 2023, analysts have noted a marked increase in the number of new entrants. In Q1 2026, they identified 16 new providers. If the current trend continues, by the end of the year the number of new players could be at least 25% higher than in 2025.
WHAT THIS MEANS FOR BUSINESS
The managing director of Kaspersky Lab in Kazakhstan, Central Asia and Mongolia, Valery Zubanov, noted that DDoS attacks can disrupt the operation of digital services.
According to him, even temporary unavailability of a website can lead to interruptions in customer service and a decline in user trust. As protective measures, the expert recommends implementing traffic filtering systems in advance, monitoring suspicious activity and providing for backup operating mechanisms.
CONTEXT
In 2025, the IT sector for the first time entered the top three most attacked industries, overtaking financial organisations. At the same time, it was IT companies that accounted for the highest share of complex targeted attacks.
In April, an interactive service featuring a map forecasting floods for spring 2026, developed by the Pavlov analytical centre “Pavlov Analytics” together with the companies Geobox and Giscarta, temporarily became unavailable due to a DDoS attack. The incident occurred during preparations for the peak of the flood season, which made the unavailability of the tool critical for users.
The editorial team of FBRK also encountered attempts to restrict access to its website. On 25 June, the publication's resource became unavailable for several hours after its hosting provider received a DMCA complaint via Cloudflare — a formal notice of alleged copyright infringement. The complaint came on behalf of Pin-Up after FBRK published material about the search for Dmitry Druzhinsky and Marina Levkovich, prepared on the basis of a press release from the Financial Monitoring Agency (FMA).
In September, the editorial team of Exclusive․kz reported DDoS attacks on its website after two publications based on the financial statements of Kazakhtelecom JSC entered Google's recommendation system. Unknown parties also created websites imitating the site's design and distributed materials in its name about former chairman of the Ak Zhol party Azat Peruashev.
In October, the Centralmedia24 website also suffered DDoS attacks. Mass requests to its servers made it difficult for the resource to function fully.
