Hacktivist groups appear to be working with commercial DDoS-for-hire providers, according to new research from Kaspersky‘s Digital Footprint Intelligence team. Of 148 DDoS providers analysed, nine showed hacktivist ties.

How the alliances work

In the cases Kaspersky observed, attacks were announced publicly and the results shared through affiliated channels. That lets providers show prospective darknet clients real results. At least four active hacktivist groups were also seen promoting self-made DDoS tools, so the landscape includes groups that build their own infrastructure and groups that rely on outside providers.

A market that advertises like any other

Providers compete for attention through aggregator sites that rank them by claimed features and “user feedback”, messaging channels with repeated promotional posts, and cybercriminal forums, where reputation systems help build credibility. Researchers also found leaderboard-style platforms, a newer mechanism that turns visibility into a competitive asset.

Kseniya Kudasheva, analyst at Kaspersky Digital Footprint Intelligence, said the DDoS darknet market “now operates much like a mainstream online market”. Understanding how it markets itself, she said, helps defenders spot emerging actors earlier and prioritise which channels to monitor.

Growth and churn

• 16 new actors appeared in the first quarter of 2026 alone. At that pace, new entrants this year could exceed the 2025 total by at least 25 per cent.
• Providers lasted about 2.5 years on average, measured from first to last advertisement.
• The oldest providers still active marked 10 years of operation last year.

Kaspersky links the growth to broader use of DDoS attacks, campaigns tied to geopolitical tensions and open-source stresser tools that lower the barrier to entry.