DDoS Attacks in Russia Rose 140.7% in the First Nine Months of 2026, with Finance Taking the Hardest Hit

Russia’s financial services sector is under heavier DDoS pressure: attacks have become more frequent and, more importantly for operators, significantly larger. According to Curator, finance led the target list in Q3 2026, while banks saw the longest attacks and the strongest bursts inside the sector.

1. Over the first nine months of 2026, the number of DDoS attacks in Russia increased by 140.7% compared with the same period last year, according to Curator, a developer of network security and online service protection tools. Curator also reported a sharp rise in large-scale attacks above 1 Tb/s.
2. In Q3 2026, fintech organizations accounted for almost a third of all incidents, or more than 31%. E-commerce companies made up 19% of attacks, while IT and telecom together accounted for 18.2%.
3. Banks were the longest-hit targets in the quarter, with attacks lasting about 200 hours. Media resources, including TV, radio, and bloggers, were hit for 75.3 hours, and gaming sites for 35.9 hours.
4. Curator said the maximum attack duration increased 2.5 times quarter over quarter and reached almost 80 hours, but the average duration still fell from 2764 seconds in Q2 to 1571 seconds in Q3. Median duration also dropped from 150 seconds to 120 seconds, returning to the level seen in Q1 this year.
5. Curator said attack organizers are trying to maximize the geographic diversification of their infrastructure, which makes simple geo-blocking less effective against large-scale DDoS attacks.

Servicepipe said banks were also taking the strongest hits within financial services in September 2026. According to deputy CEO Daniil Shcherbakov, attacks on exchanges, payment infrastructure, and gas stations reached up to 10 Gbit/s, while banking systems were hit by attacks of up to 300 Gbit/s. Most of those attacks lasted only 2 to 12 minutes, a short-burst pattern meant to test filtering and outrun the cyber defense response.

Shcherbakov also said application-layer attacks are growing in intensity. In September, peak load on fintech web resources reached almost 11 million requests per minute, with attackers aiming to overload authorization servers and databases and make financial operations unavailable to customers.