Stefan Meinders
Stefan Meinders has more than 20 years of experience in network security, DDoS mitigation, and large-scale traffic analytics. In his current role at NETSCOUT Arbor, he works with service providers, cloud environments, and network operators on DDoS visibility, defense strategy, and operational resilience. His work gives him direct insight into how botnet-driven attack campaigns are evolving and how mitigation strategies must adapt to protect modern infrastructure.
Session
DDoS defense strategies must evolve because modern botnet campaigns combine high-volume, direct-path pressure with stealthier tailored attack components that attempt to overload and evade mitigation systems.
In the past, most DDoS attacks were easier for ISPs to identify and block. The hardest cases were botnet-based Layer 7 attacks because they were more difficult to detect and mitigate.
Successfully blocking DDoS attacks today requires more than the techniques that worked in the past. Over the past months, botnet size and firepower have increased dramatically. These botnets now drive some of the largest and most effective attacks, not only against individual applications but also against entire network infrastructures, cloud providers, and CDNs.
At the end of 2025, we observed record-breaking attacks. This talk explains why we believe those attacks happened, why they continue, and what they reveal about the evolution of botnet-driven DDoS campaigns.
Multi-terabit attacks have become much more common, but it is not just the volume of DDoS traffic that is taking down web sites and other targets around the world. The real problem is the tailored, targeted, and dynamic attack components that knock servers offline while remaining below the visibility threshold of many traditional defenses.
Today’s large-scale, direct-path attacks increasingly include multiple attack vectors, blending volumetric, state-exhaustion and application-layer components. These botnet-based attacks are designed to overload mitigation capabilities and resources.
This talk explains what enabled the expansion of botnets behind today’s attack campaigns and where these new bots are located. For network operators, this matters because these bots now require inbound, outbound, and cross-bound DDoS detection and mitigation.
These insights are based on ATLAS, our worldwide DDoS monitoring system.
Attendees will leave with a clearer understanding of why botnet-driven DDoS campaigns now demand mitigation strategies that account for visible volumetric pressure and lower-profile attack components at the same time.