News

A newer and more disruptive DDoS technique is changing how attacks are built, and why they are so difficult to stop. It is known as a carpet bombing DDoS attack, and understanding how it works matters, because the defences that stopped DDoS attacks in Ireland a few years ago are often blind to this one.

What Is a Carpet Bombing DDoS Attack?

The name comes from military terminology, and the analogy holds up well. Rather than a precision strike on one address, a carpet bombing attack spreads traffic thinly across an entire block of IP addresses — potentially hundreds or thousands belonging to the same organisation or the same internet service provider. Each individual IP address might only receive a small, unremarkable amount of traffic. But added together across the whole range, the total volume is enormous, aiming to inflict damage broadly rather than concentrate it on a single point.

This is a meaningful departure from how DDoS attacks traditionally worked. A traditional DDoS attack concentrates its full force on a single IP address — a website, a login portal, a VoIP gateway. Volume is the whole strategy: overwhelm one target with enough traffic that it can no longer serve legitimate users. The target is obvious, the impact is visible, and the fix — usually filtering traffic to that one IP address — is well understood by most IT teams and their internet providers.

Carpet bombing was built to get around exactly that kind of defence, and it has two consequences that matter a great deal to businesses and their IT providers.

• First, it evades traditional detection. Most DDoS monitoring is built to flag one thing: an unusual spike in traffic to a single IP address. Carpet bombing is engineered specifically to stay under that threshold on every individual address, while still generating attack-scale volume in total. A defence system watching each IP in isolation may see nothing worth alerting on, even as the network as a whole is under serious strain.

• Second, it can affect far more than the intended target. Because the traffic is distributed across shared infrastructure, a carpet bombing attack aimed at degrading one organisation’s service can also degrade performance for every other business sharing that IP range or that provider’s network. A business with no direct connection to the intended target can still experience slowdowns, packet loss, or outages purely because of where its infrastructure sits.

This is why carpet bombing represents a genuine evolution in threat sophistication rather than simply a bigger version of the same attack. It is designed to be harder to see, harder to attribute to a single cause, and harder to mitigate with tools built around the old assumption that a DDoS attack has one obvious victim.

The Scale of the DDoS Threat in Ireland

DDoS is not a distant, theoretical risk for Irish organisations. Recent research from the Irish Information Security Forum found that 40% of Irish businesses experienced a cyberattack in the past 12 months, and within that group, 36% specifically reported a DDoS attack (iisf.ie). That puts DDoS among the most commonly experienced attack types facing Irish organisations today, not a niche concern reserved for large enterprises or public infrastructure.

Domestic enforcement figures tell a similar story. The Garda National Cyber Crime Bureau opened 633 new cases in 2025, underscoring how frequently Irish organisations and individuals are now reporting cybercrime through formal channels, DDoS incidents among them. It is a measurable, rising pattern of activity, and evasive variants like carpet bombing are a growing part of it.

Which Irish Sectors Are Most Exposed to DDoS Attacks

DDoS activity is not distributed evenly across the economy. Certain sectors carry disproportionate exposure, either because of what they do, what data they hold, or how central they are to daily business and public life.

• Communication Service Providers sit at the top of the list, accounting for 37.18% of DDoS activity affecting Irish organisations. This makes sense given their role: providers carry traffic for thousands of downstream customers, making them both a high-value target and a single point where an attack, including a carpet bombing attack spread across an address range, can ripple out to affect many businesses at once.
• Financial Services follows at 25.26%. Banks, insurers, and payment providers depend on continuous availability, and even short outages carry direct financial and reputational cost, along with regulatory scrutiny. The sector’s reliance on always-on digital channels makes it a natural and recurring target.
• eCommerce accounts for 12.74% of activity. Online retailers are particularly sensitive to downtime because revenue is tied directly to uptime, especially during peak trading periods, seasonal sales, and promotional windows when attackers know disruption will cause maximum commercial damage.

Beyond these headline sectors, two areas deserve particular attention from an Irish risk management perspective.

• Public services, especially hospitals and local government, are increasingly exposed. These organisations hold large volumes of sensitive personal and operational data, making them attractive targets, while often operating with cybersecurity budgets that have not kept pace with the scale of the threat. The SME Cyber Resilience: State of the Sector 2025 report (cyberresilience.ie) found that healthcare recorded the lowest cyber resilience score of any sector among Irish SMEs, at just 3.3 out of 10, despite being one of the highest-value targets for attackers due to the sensitivity of patient data and the operational disruption an outage can cause.
• Research institutions and academia are also drawing more attention, including from nation-state actors. Reporting from Microsoft’s News Centre Europe has highlighted a broader pattern of state-linked groups expanding their focus beyond traditional government and critical infrastructure targets into research and higher education, often seeking access to intellectual property, research data, or a foothold into wider networks. Irish universities and research bodies, some holding internationally significant research, are not exempt from this trend.

Separately, the Hiscox Cyber Readiness Report 2025 (hiscox.ie/crr2025) points to a persistent gap between the frequency of attacks organisations are experiencing and the maturity of their readiness to respond, a gap that shows up clearly in sectors like healthcare and local government where resources are stretched thinnest.

Taken together, this points to a threat landscape where exposure is not limited to the obvious targets. Any organisation that depends on continuous connectivity, holds sensitive data, or sits on shared infrastructure with a higher-profile target carries some level of risk.

Building DDoS Resilience: What Irish Businesses Should Be Doing

The nature of carpet bombing attacks means that visibility and response speed matter more than ever. A defence built only around monitoring individual IP addresses for spikes will miss an attack engineered to stay under that radar. Resilience needs to be built at the network level, not the individual asset level.
A few principles should guide how Irish businesses think about DDoS readiness:

• Assume distributed attacks, not just concentrated ones. Any DDoS mitigation strategy should account for attacks spread across an entire address range, not only traffic spikes aimed at a single IP. This means monitoring aggregate traffic patterns across the full block of addresses an organisation uses, not just the ones deemed highest-profile.
• Build detection and response into the connection itself, rather than bolting it on after an incident. Real-time detection and traffic scrubbing, applied continuously rather than reactively, closes the window attackers rely on. The earlier malicious traffic is identified and filtered, the less chance it has to affect legitimate users and services.
• Treat DDoS protection as part of core connectivity, not a separate afterthought. For organisations that depend on Dedicated Internet Access to run customer-facing websites, cloud applications, remote access tools, or voice services, protection against DDoS disruption is best delivered as an integrated layer of that connection, not a standalone tool bolted on elsewhere in the stack.
• Have expert support on hand during an active event. When an attack is underway, the value of experienced engineers who understand the traffic patterns and can act quickly should not be underestimated. Speed of response often determines whether an attack becomes a brief blip or a prolonged outage.

This is the thinking behind Magnet Plus DDoS Protection, available as an advanced security add-on to Magnet Plus Dedicated Internet Access. It combines real-time detection with continuous traffic scrubbing, filtering malicious traffic before it disrupts a connection, while legitimate users and services continue operating as normal. Backed by 24/7 expert support and proactive monitoring, it is designed to add a meaningful layer of resilience for businesses that cannot afford unplanned downtime, without requiring a separate security platform or vendor relationship.

Given how quickly the threat has evolved, and how exposed sectors like communications, financial services, eCommerce, healthcare, and public bodies now are, the question for most Irish organisations is no longer whether DDoS protection is necessary. It is whether current defences are built to withstand the attacks actually being used against them today, including the ones designed specifically to go unnoticed.

If you are unsure how your organisation’s current setup would hold up against a distributed, low-and-slow attack like carpet bombing, a DDoS resilience assessment is a practical next step. It offers a clear picture of where exposure exists and what a layered, connection-level defence would look like for your specific environment.

Schedule a DDoS resilience assessment with Magnet Plus today.

Frequently Asked Questions

• What is a carpet bombing DDoS attack? A carpet bombing DDoS attack spreads malicious traffic across an entire block of IP addresses rather than targeting one address directly. Each IP receives a small, easy-to-miss volume of traffic, but the combined total across the range is large enough to disrupt a network or service.
• How is carpet bombing different from a traditional DDoS attack? A traditional DDoS attack floods a single IP address until it goes offline, making the target and the fix straightforward. Carpet bombing distributes that same volume across many addresses at once, so it can evade detection systems built to flag spikes on individual IPs and can affect other organisations sharing the same address range or provider.
• Why is carpet bombing hard to detect? Most DDoS monitoring tools watch each IP address in isolation for unusual spikes. Because carpet bombing keeps traffic to any single address below that threshold, it can generate attack-scale volume in total without tripping conventional alerts.
• How can Irish businesses protect against carpet bombing attacks? Effective protection requires monitoring traffic across an entire IP range rather than individual addresses, combined with real-time detection and continuous traffic scrubbing built into the connection itself. Solutions like Magnet Plus DDoS Protection add this layer directly to Dedicated Internet Access, backed by 24/7 expert support.

Sources

• Irish Information Security Forum, DDoS Analysis Report: https://www.iisf.ie/
• Hiscox Cyber Readiness Report 2025: https://www.hiscox.ie/crr2025
• Microsoft News Centre Europe, “Extortion and ransomware drive over half of cyberattacks”: https://news.microsoft.com/europe/2025/10/16/extortion-and-ransomware-drive-over-half-of-cyberattacks/
• SME Cyber Resilience: State of the Sector 2025, Munster Technological University and the NCSC: https://cyberresilience.ie