II Cyber Warfare & Critical Infrastructure
DDoS (distributed denial-of-service attack)
An attack in which many compromised devices flood a single target with bogus traffic at once, cutting real users off from a website or network.
How it works
According to CISA, the US cybersecurity agency, a denial-of-service (DoS) attack stops legitimate users from reaching a system, device or network resource, usually by flooding the target with traffic. In the distributed (DDoS) variant, the attack comes not from a single machine but from many machines working together.
These machines often form a botnet: internet-connected devices hijacked without their owners' knowledge. Internet of Things devices left with their default passwords are a major source of botnets, and some botnets are rented out as attack-for-hire services. Because the attack comes from so many sources, tracing its origin is difficult.
A DDoS attack does not steal data; it targets availability. The symptoms are a slow network, a particular site that will not load, or no sites reachable at all. Ordinary faults and maintenance can produce the same symptoms, so an attack can be confirmed only by monitoring traffic. CISA also warns that attackers may use DDoS as a diversion from other attacks.
Why it matters here
It is the cheapest pressure tool for state-linked or pro-government groups. Outages usually last only hours, but the timing carries a political message. Hitting ministry, airport and bank websites on the day of a summit, an election or a diplomatic crisis buys visibility more than damage. In the Talay reading, a DDoS report is not a crisis on its own. The real signal is the breadth of the target list, any intrusion attempt running in parallel, and whether governments formally attribute the attack to a state.