Botnets before the ballots: US midterms at risk? | perspective

COMMENTARY: Distributed-Denial-of-Service (DDos) attacks keep setting records, but none of the biggest ones have targeted an election.

In November 2025, Microsoft reported that Azure had mitigated a 15.72 terabit-per-second attack, the largest cloud DDoS attack yet seen. That record did not last. A 31.4 terabit-per-second flood (tied to the same Aisuru botnet) was reported by Cloudflare before the year was out.

These record-breaking attacks have set the tone for how the industry talks DDoS risk everywhere, elections included. However, focusing on the attacks’ size may miss the key point.

Many assume that the record-breaking attack will finally take an election system down. Fifteen years of DDoS attacks on elections argue otherwise. Trace the incidents that actually knocked something offline, and we’ll see that the size of the attack doesn’t matter.

Back in October 2011, an aide to a South Korean lawmaker orchestrated an attack against the National Election Commission's website during a Seoul mayoral by-election, timed for the morning hours when younger voters, who leaned toward the opposition, typically checked their assigned polling locations before work. The attack ran on a handful of hijacked connections, unremarkable by any measure. It needed two hours to do its job. Nobody had built the system to withstand that kind of pressure and by the time it came back online, the voters it targeted had started their workday. The aide was later convicted, and the lawmaker resigned.

Five years later, a different kind of warning arrived. On October 21, 2016, the Mirai botnet took down Dyn, a DNS provider a large of the internet depended on. Dozens of sites including X (then Twitter) and went dark for hours. Dyn was not election infrastructure, but with the vote three weeks away, security expert Stephen Gates told Fox News a similar outage could hit voter registration systems and polling centers directly, saying that any “delays in reporting could seriously impact people's desire to vote and even worse, trust the results.” The attack was not the largest, yet it took down infrastructure nobody had validated would hold – and that’s exactly what made the warning land.

This pattern held outside the U.S., too. North Macedonia's State Election Commission website went offline for three hours during vote counting in July 2020. Back in the U.S., Colorado and Kentucky lost state government sites to the pro-Russian group KillNet in the run-up to the 2022 midterms, after KillNet publicly listed a dozen states as targets. That same year, several state sites in Mississippi went intermittently inaccessible on Election Day.

None of these attacks were remarkable in their sophistication. But each produced the same result: an online service people needed in that exact moment was not available.

Moldova's September 2025 parliamentary election stands as the closest thing to an exception, and it proves the same rule from the other direction. Attackers built a botnet from thousands of compromised routers and directed more than 16 million attack sessions at the country's central election infrastructure. It was, by volume, the largest coordinated effort on this list. It also failed, because Moldova's systems had been hardened and tested against exactly this kind of scenario in advance.

Attackers going after election infrastructure are rarely trying to alter a result. Vote-counting systems are typically air-gapped, audited, and better defended than the public-facing sites around them.

The actual target is confidence. A donation page timing out, a results page stalling, or a state site that isn’t working well on Election Day may not change a single vote but it’s enough to make the process look unreliable. A small attack against an untested target may accomplish that more effectively than a large attack against a hardened target, and that’s exactly why size was never the variable that mattered.

Fifteen years in, the industry still tends to focus on the record-breaking DDoS attacks. Ahead of the U.S. midterms, security teams should confirm, under realistic conditions, that the specific systems voters will rely on this cycle (registration lookups, polling place finders, results feeds, county sites) would hold against vectors most likely used against them and know when this was last checked.

History suggests that the ability to keep election systems online has less to do with the size of the DDoS attack a target faced. It’s actually got much more to do with whether anyone found out before an attacker did, and what a much smaller attack might do to disrupt an election.

Matthew Andriani, founder and CEO, MazeBolt

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.