Cybercriminals running distributed denial-of-service (DDoS) attacks are increasingly turning to public leaderboards and Telegram bots to market their services, according to new research from Kaspersky.

Researchers at Kaspersky Digital Footprint Intelligence (DFI) found that attack dashboards now rank DDoS operators by metrics such as requests per second or throughput in gigabits per second, then post the results on public leaderboards. The result is visible proof of performance that attackers can use to attract paying customers.

Attack performance becomes a sales pitch

Through a website or Telegram bot, a participant picks their infrastructure and attack method, launches an attack, and receives a score. That score then appears on a public leaderboard alongside other operators, letting them compare performance and show off their capabilities in the same interface.

“For defenders, the challenge goes beyond attack volume to the growing commercialisation and visibility of offensive capabilities,” said João Pedro Brandão e Silva, Kaspersky Digital Footprint Intelligence analyst. “What is particularly striking is how closely this ecosystem now resembles a conventional industry: DDoS actors are competing for customers, differentiating their services, and using public leaderboards and performance dashboards to prove results.”

In some communities, the rankings have turned into long-running competitions, with prizes offered to operators who hold the top spot for six consecutive months. That turns operational telemetry into both a reputational asset and a built-in promotional channel.

DDoS as one service among several

Kaspersky’s researchers found that this commercial approach often extends beyond DDoS itself. Of the DDoS providers advertising on cybercriminal forums in the dataset analysed, 43% also promoted side services. These fall into two categories: reusing infrastructure, malware and attack tools for adjacent abuse such as spam campaigns and mass reporting, and reusing knowledge through consulting, training or defensive offerings built on the same experience.

To stay competitive, providers are also leaning on proprietary attack methods rather than public tools, using techniques such as traffic amplification, advanced request handling and evasion designed to mimic legitimate traffic. Kaspersky found that 33% of actors explicitly claimed they could bypass anti-DDoS protections, naming 32 vendors across Layer 4, Layer 7 and game server protection.

What businesses should do

Kaspersky recommends that organisations adopt a digital risk protection service that monitors their digital assets across the surface, deep and dark web, and give security teams visibility into threats through dedicated threat intelligence. It also suggests keeping employees aware of relevant threats and pairing existing defences with human-led detection and response capabilities such as managed detection and response (MDR).

The full findings are published in Kaspersky’s Digital Footprint Intelligence report.