DigiCert has published its inaugural RADAR Threat Intelligence Brief, a quarterly report offering detailed insights into new cyber dangers. Sourced from vast data garnered through DigiCert's global security services—UltraDNS, UltraDDoS Protect, and UltraWAF—RADAR delivers a comprehensive snapshot of the shifting threat ecosystem.
The Q3 2025 report sheds light on a sharp increase in distributed denial-of-service (DDoS) attacks, described as reaching "internet tsunami" levels. Notable incidents peaked at 2.4 terabits per second (Tbps) and 3.7 Tbps, marking a substantial transformation in cyber conflict dynamics where the internet itself assumes a dual role as both the offensive tool and battleground.
Key insights from the Q3 2025 RADAR report
- Record-Breaking DDoS Attacks: DigiCert's UltraDDoS Protect network successfully mitigated several multi-terabit attacks, the largest recorded so far, saving customers about 3,000 hours of potential website downtime.
- Geopolitical Shifts and Cyber Risks: A significant portion of attack traffic is traced back to regions where digital infrastructure expands faster than regulatory measures, notably Vietnam, Russia, Colombia, and China, which are among the top five sources.
- Higher Education Under Siege: Universities and academic networks experienced heightened DDoS activity in September, surpassing sectors like financial services and IT/Software services. This corresponds with peak enrolment times and relatively open network infrastructures.
- The Rise of Automated Threats: Malicious web activity surged from 51% in July to 73% in September, with September alone witnessing 32 million bot violations, indicating that automation is increasingly driving large-scale cyber assaults.
- DNS Errors Highlight Internet Vulnerabilities: A notable 22,000% rise in DNS misconfigurations underscores the widespread impact potential of even minor technical issues across the digital landscape.
Precision and scale in cyberattacks
Smith highlighted the necessity for organisations to maintain broad visibility across their infrastructure
Michael Smith, AppSec CTO at DigiCert, remarked, “Attackers are not just choosing between precision and scale anymore, they’re mastering both.” He noted that targeted precision attacks were prevalent in two of the three months, while in August, large-scale "carpet-bombing" campaigns comprised 65% of all incidents.
Emphasising the growing complexity of threats, Smith highlighted the necessity for organisations to maintain broad visibility across their infrastructure, applications, and identity to ensure resilience.
Focus on critical regions
Smith further noted, "The United States bore the brunt of these attacks, accounting for 58% of global DDoS activity, followed closely by the United Kingdom (11%) and Saudi Arabia (11%)."
He explained that adversaries are targeting critical infrastructure and geopolitically sensitive areas, where disruptions can provoke significant cascading effects.
Find out about secure physical access control systems through layered cybersecurity practices.
