Critical networks face stealthy intrusions, record-breaking DDoS attacks and rising cryptographic demands, according to Nokia study

Press Release
Critical networks face stealthy intrusions, record-breaking DDoS attacks and rising cryptographic demands, according to Nokia study

• Nearly 2 in 3 telecom operators experienced at least one “living off the land” attack the past 12 months, and 32% saw four or more.
• Terabit-scale DDoS attacks are happening five times more frequently and with greater peak strength, as 4% of the world’s home internet connections are compromised; some 37% of DDoS attacks now end within two minutes.
• More than 70% of telecom security leaders now prioritize AI- and ML-based threat analytics, and over half plan to deploy AI for detection within 18 months. 
  
  

8 October 2025  
Espoo, Finland – Cyber attackers are increasingly penetrating core telecom infrastructure undetected; DDoS attacks have surged to new extremes, powered by compromised home internet connections; and crypto agility is moving from roadmap to requirement, according to Nokia's 11th annual Threat Intelligence Report.

Stealthy campaigns now target the telco core
Attackers have stepped up their intrusions into core networks, in some cases reaching sensitive systems such as subscriber data and lawful interception platforms, as seen in the high-profile Salt Typhoon case. They often hide in plain sight by abusing trusted tools, unpatched devices and misconfigurations.

• 63% of operators faced at least one “living off the land” attack last year; 32% saw four or more.
• Multi-year, low-profile infections have led to major data exposure and forced operators into costly remediation, highlighting the business and reputational risks of long-term, privileged access.
• As the CISO from one leading CSP in North America said, “Salt Typhoon was the most significant cybersecurity incident we faced in the last 12 months. … Some of the entry points were put in place years ago, just sitting and waiting for the right moment to trigger.”
  
  

DDoS attacks are shorter and more powerful
Terabit-scale DDoS attacks are now a daily reality, up from once every five days in 2024, and gigabit residential broadband connectivity is amplifying the dangers.

• DDoS peaks in the 5 to 10 Tbps range are the “new normal,” escalating faster than most alert systems can raise alarms.
• Some 78% of DDoS attacks now end within five minutes (up from 44% in 2024), with 37% wrapping up in under two minutes, highlighting the need for rapid detection and mitigation.
• Over 100 million residential endpoints (4% of the global total) are now available for exploits and malicious uses of bandwidth.