DDoS Attacks in Indonesia Surge 62 Percent, Posing Challenge for Cybersecurity Industry

Cybersecurity firm StormWall, which specialises in DDoS protection, has reported that DDoS attacks against organisations in Indonesia increased by 62 per cent compared to the same period in the previous year during the first quarter of 2026.

StormWall’s founder and CEO, Ramil Khantimirov, explained that the company mitigated over 280,000 attacks targeting organisations in Indonesia during the first three months of this year, averaging approximately 3,100 attacks per day.

“Around 70 per cent of attacks against targets in Indonesia are financially motivated, with 41 per cent of them accompanied by ransom demands,” Ramil stated in a briefing on Friday, 19 June 2026.

This figure is higher than the global average, which sits around 30 per cent. These findings warrant attention, given that globally, hacktivism-driven attacks were more prevalent than commercially motivated attacks in Q1 2026, partly due to ongoing conflicts in the Middle East.

“DDoS attacks in Indonesia also last longer than the global average. Only 62 per cent of attacks end in less than five minutes, whereas the global figure reaches approximately 78 per cent,” he added.

From a technical perspective, the number of multi-vector attacks increased by 47 per cent compared to the previous year. Currently, 62 per cent of all attacks combine two or more attack vectors, while 26 per cent combine three or more vectors. Conversely, probing attacks increased by 81 per cent, while carpet bombing attacks rose by 76 per cent.

Among the sectors most frequently targeted, the telecommunications sector holds the top position, accounting for 26 per cent of all attack traffic. This is followed by the entertainment industry (22 per cent) and the financial sector (17 per cent).

Notably, the entertainment industry is a more dominant target in Indonesia than globally. According to StormWall data, only 9 per cent of DDoS attacks worldwide target this sector.

“In Indonesia, DDoS attacks are more closely related to money than to politics,” said Ramil.

He added that one trend observed by the firm is the increase in ‘low-and-slow’ probing activity, which involves low-intensity attacks that progress gradually. In these instances, attackers deliberately keep traffic volumes below detection thresholds to identify vulnerabilities before launching a primary attack.