Real-world DDoS attack incident response case study
A major DDoS attack does not have to last for hours to become a business crisis. According to Cloudflare’s DDoS Threat Report for H1 2026, more than 90% of the network-layer DDoS attacks observed by the company ended within 10 minutes. During the same period, Cloudflare mitigated hundreds of attacks exceeding 1 Tbps, reinforcing a difficult reality for enterprises: modern DDoS attacks can be both extremely large and extremely short-lived.
One real-world example in Vietnam involved an anonymized securities company documented by VNETWORK. According to the provider’s H1 2025 DDoS report, the organization faced an attack peaking at 1.2 Tbps and more than 720,000 requests per second. After a managed security platform was integrated, the trading environment was reported to have returned to a stable state within approximately five minutes, supported by 24/7 SOC monitoring and layered mitigation controls.
This DDoS attack incident response case study is valuable because the challenge went far beyond simply “blocking malicious traffic.” The incident highlights the importance of infrastructure capacity, continuous monitoring, application and API protection, SOC operations, escalation procedures, and coordination between an internal IT team and a Managed Security Services provider.
DDoS in 2026 is no longer just a bandwidth problem
Distributed Denial of Service, or DDoS, attacks attempt to degrade or completely disrupt a service by overwhelming infrastructure, applications, or network resources with more traffic or requests than they can process.
Modern DDoS campaigns, however, do not necessarily target only network bandwidth.
At the network layer, attackers may attempt to saturate Internet connectivity or exhaust network devices. At the application layer, attacks may target websites, APIs, DNS infrastructure, authentication services, or resource-intensive functions that consume CPU, memory, or database capacity.
Cloudflare’s H1 2026 data shows that attacks above the 1 Tbps threshold have become increasingly significant, while DNS floods and reflection/amplification techniques remain relevant attack vectors.
More importantly, 90.6% of network-layer DDoS attacks mitigated by Cloudflare lasted less than 10 minutes. In such cases, an Incident Response model that depends entirely on a human analyst receiving an alert, investigating it manually, approving a mitigation rule, and deploying it may simply be too slow.
For additional context on attack trends, enterprises can also review IPSIP Vietnam’s analysis of DDoS attacks in H1 2026
DDoS attack incident response case study at a Vietnamese securities company
According to VNETWORK, an anonymized Vietnamese securities company relied primarily on physical firewalls and basic attack protection before the incident.
The DDoS campaign eventually peaked at approximately 1.2 Tbps and more than 720,000 requests per second. The documented attack activity involved Layer 3, Layer 4, and Layer 7 traffic, along with API flooding and application-level attack activity.
Before the managed security platform was integrated, the campaign reportedly continued for several days.
According to VNETWORK, four hours of downtime were estimated to have caused more than VND 200 billion in transaction-related losses, while more than 86% of payment orders were delayed or disrupted. The internal IT team remained on continuous duty but struggled to control the volume and complexity of the traffic.
These figures were published by the security provider involved in the case and should therefore be understood as provider-reported case study data rather than independently audited financial results.
The core lesson is straightforward:
👉 A firewall was in place. An IT team was available. But neither alone provided sufficient capacity to absorb and manage an attack of this scale.
Why a Firewall alone may not stop a 1.2 Tbps DDoS attack?
A firewall remains an essential security control, but it is not synonymous with a complete DDoS defense architecture.
If malicious traffic exceeds the capacity of the enterprise’s Internet connection or upstream infrastructure, congestion may occur before the traffic even reaches the on-premises firewall.
This is why enterprise DDoS protection commonly combines several layers:
upstream DDoS mitigation or traffic scrubbing;
CDN and distributed network capacity;
Web Application Firewall (WAF);
API protection;
rate limiting;
bot mitigation;
firewall or NGFW controls;
SIEM, NDR, or other telemetry sources;
continuous SOC monitoring;
incident escalation and response procedures.
The firewall therefore remains one defensive layer, not the entire defensive strategy.
For organizations that require continuous firewall operations and security policy management, IPSIP also provides Managed Firewall 24/7
How Managed Security Services support DDoS incident response?
The main advantage of Managed Security Services is not simply outsourcing the installation of a security appliance.
The value comes from combining technology, people, monitoring capabilities, operational procedures, and escalation mechanisms.
1. Adding mitigation capacity beyond on-premises infrastructure
For a terabit-scale DDoS attack, it is rarely economically practical for an individual enterprise to maintain several terabits of spare capacity purely for emergency use.
A Managed Security Services model allows organizations to leverage distributed infrastructure and specialized mitigation capabilities when needed.
2. Separating legitimate users from malicious traffic
Blocking every incoming connection would technically stop malicious requests—but it would also stop customers.
The real challenge is maintaining access for legitimate users while filtering automated traffic, attack requests, bots, and malicious patterns.
The case study describes the use of traffic analysis, WAF controls, API protection, rate limiting, and distributed traffic management rather than relying solely on mass IP blocking.
3. Continuous monitoring instead of one-time mitigation
Attackers can change vectors when an existing technique stops working.
After initial recovery, security teams may still need to monitor:
traffic patterns;
request rates;
source distribution;
targeted endpoints;
APIs;
firewall events;
WAF events;
DNS behavior;
application anomalies.
👉 A 24/7 SOC provides enterprises with continuous monitoring capabilities that can support detection, triage, escalation, and coordination during security incidents.
4. Reducing operational pressure on internal IT teams
During a major incident, the internal IT team still has to manage infrastructure, users, stakeholders, business services, vendors, and internal communications.
Requiring the same team to simultaneously investigate traffic, tune firewall rules, analyze logs, coordinate with ISPs, protect APIs, and report to management can quickly create operational overload.
Managed Security Services provide an additional specialized response layer when an incident exceeds the resources or expertise available internally.
DDoS and Malware defense requires a layered security model
One of the broader lessons from Incident Response is that organizations should avoid designing security around a single “all-powerful” control.
DDoS and malware affect different parts of the environment and require different defensive capabilities.
Security layer | Role against DDoS | Role against malware |
CDN / Anti-DDoS / Scrubbing | Absorbs and filters large-scale traffic | Limited |
WAF | Helps block HTTP floods and Layer 7 abuse | Can block some application exploits |
Firewall / NGFW | Enforces network policies | Can block suspicious connections and known C2 activity |
API Protection | Protects endpoints from API flooding and abuse | Reduces API exploitation risks |
Rate Limiting / Bot Management | Restricts abnormal automated requests | Limits malicious automation |
EDR / XDR | Not a primary DDoS control | Detects and responds to endpoint threats |
NDR | Detects abnormal network behavior | Helps identify lateral movement and command-and-control |
SIEM / SOC | Correlation, detection, and Incident Response | Correlation, investigation, and response |
Backup / Disaster Recovery | Supports service continuity | Critical for ransomware and destructive malware |
This creates a defense-in-depth architecture in which the failure or limitation of one control does not immediately leave the organization without visibility or protection.
Security crisis management timeline: how the incident was handled
The public source does not provide a minute-by-minute Incident Response log for the entire event. Therefore, it would be misleading to invent artificial timestamps such as T+5, T+15, or T+30 minutes.
Instead, the incident can be mapped according to the response stages supported by the available information.
Incident stage | Observed situation | Response action | Objective |
Before managed mitigation | Multi-day attack activity with traffic peaking at 1.2 Tbps | Internal IT team and existing controls attempted to handle malicious traffic | Maintain service availability |
Escalation | Existing capacity became insufficient | Specialized provider support was activated | Increase mitigation capacity |
Managed platform integration | Security platform was brought into the traffic path | Traffic analysis and mitigation controls were applied | Stabilize the trading platform |
Multi-layer mitigation | Layer 3/4/7 and API-related attacks were identified | Multi-CDN, WAF, API protection, filtering, and rate controls were applied | Separate malicious traffic from legitimate users |
Continuous monitoring | Attack behavior continued to evolve | SOC analysts monitored activity and adjusted protection rules | Prevent renewed disruption |
Post-incident phase | Services returned to a stable state | Monitoring, reporting, optimization, and security improvement | Reduce recurrence risk |
According to the case study, 24/7 SOC personnel monitored activity in real time, analyzed attack vectors, and adjusted mitigation rules as attack behavior evolved.
This aligns with modern Incident Response guidance from the National Institute of Standards and Technology (NIST). NIST SP 800-61 Rev.3 integrates Incident Response into the broader cybersecurity risk management lifecycle rather than treating it as an isolated process that begins only after a breach or disruption has occurred.
👉 Organizations building their own internal response procedures can also refer to IPSIP’s Incident Response Guide
Another public example: HSC and DDoS resilience
A second Vietnamese example with a publicly disclosed company name involves Ho Chi Minh City Securities Corporation (HSC).
According to a VNETWORK case study, HSC deployed VNIS to protect its web and application environment using Cloud WAF and DDoS mitigation capabilities, with continuous traffic monitoring and automated alerting.
VNETWORK states that HSC encountered several DDoS attacks that were not necessarily extremely large but were still capable of slowing down systems. In the incidents described, the protected applications remained available and trading operations could continue.
This HSC case and the 1.2 Tbps anonymized securities company case are separate incidents. Their data should not be combined or attributed to the same organization.
What they have in common is the security model: protection goes beyond a standalone firewall and combines traffic security, WAF, DDoS mitigation, monitoring, and operational response.
Results after the incident response process
For the anonymized securities company case, VNETWORK reported that after its platform was integrated:
the trading environment returned to a stable state within approximately five minutes;
24/7 monitoring continued after initial recovery;
mitigation policies were adjusted based on actual attack behavior;
malicious traffic was filtered while legitimate traffic was maintained;
trading services returned to stable operation.
These results should not be interpreted as a universal service-level guarantee.
Recovery time depends on factors including:
network architecture;
ISP capacity;
DNS configuration;
cloud and CDN infrastructure;
firewall capacity;
origin server design;
application architecture;
attack vector;
integration readiness;
existing Incident Response procedures.
What legal requirements should enterprises consider for cyber incident response in Vietnam in 2026?
As of August 2026, Vietnam’s cybersecurity regulatory framework has undergone significant changes that enterprises should take into account when developing or updating their Incident Response plans.
The Cybersecurity Law No. 116/2025/QH15 was passed by the National Assembly on December 10, 2025, and took effect on July 1, 2026. The law was developed by inheriting and consolidating relevant provisions from the 2018 Cybersecurity Law and the 2015 Law on Cyberinformation Security. When Law No. 116/2025/QH15 entered into force, those two previous laws ceased to have effect.
Another important development came on August 19, 2026, when the Government issued Decree No. 333/2026/ND-CP, which also took effect on the same date. The Decree provides detailed regulations and implementation measures for the Cybersecurity Law. Among other matters, it covers cybersecurity protection measures such as cybersecurity assessment, inspection and monitoring, as well as cyber incident response and remediation.
The Government also issued Decree No. 331/2026/ND-CP on August 19, 2026, governing cybersecurity protection for information systems. The Decree addresses requirements associated with information-system security levels, protection measures, and the responsibilities of relevant organizations in protecting systems according to their applicable classification.
For enterprises, this reinforces an important point: Incident Response should not be treated simply as an IT team’s technical reaction after an attack occurs.
A mature Incident Response capability should be integrated with broader organizational governance, including system ownership, access and authorization controls, escalation procedures, security monitoring, incident documentation, evidence preservation, post-incident remediation, and any regulatory obligations applicable to the organization and its information systems.
In a DDoS incident, for example, restoring service availability may be the immediate technical priority. However, the response process should also preserve relevant logs and evidence, document decisions and mitigation actions, establish clear responsibilities between internal teams and external service providers, and support any subsequent investigation or compliance requirements.
This is another reason why enterprises should develop an Incident Response Plan before a major attack occurs. The objective is not only to recover faster, but also to ensure that technical response, business continuity, security governance, and applicable legal requirements remain aligned throughout the incident lifecycle.
Five lessons enterprises can learn from this DDoS case study
1. Do not wait for an attack before identifying who to call
During a major DDoS incident, searching for provider contacts, negotiating emergency support, changing routing, and integrating new mitigation services all consume valuable time.
Organizations should identify in advance:
ISP escalation contacts;
cloud/CDN contacts;
SOC or MSSP contacts;
internal escalation paths;
personnel authorized to modify DNS, routing, or firewall policies;
crisis communication owners.
2. Test real capacity instead of simply stating that “DDoS protection exists”
The more useful question is not:
“Do we have a firewall?”
It is:
“What fails first if we receive 10 Gbps, 100 Gbps, or 1 Tbps of hostile traffic?”
The bottleneck may be the ISP connection, router, firewall, load balancer, origin infrastructure, application server, or database.
3. Include websites, APIs, and DNS in the Incident Response scope
Protecting the main website while leaving authentication APIs, payment endpoints, or DNS as single points of failure creates a significant resilience gap.
Asset inventory should therefore cover all business-critical Internet-facing systems.
4. Automation matters when attacks last only minutes
For short-lived DDoS attacks, manual response alone may not be fast enough.
Automation can handle well-defined detection and mitigation actions, while SOC analysts focus on validation, escalation, coordination, and high-impact decisions.
5. Recovery does not mean Incident Response is over
Restoring the website is one milestone, not the end of the incident.
Post-incident activities should include:
reviewing logs;
identifying attack vectors;
assessing impact;
reviewing security configurations;
checking whether DDoS activity concealed another intrusion attempt;
updating response playbooks;
conducting a post-incident review.
NIST SP 800-61 Rev.3 similarly emphasizes integrating lessons learned and recovery activities into an organization’s broader cybersecurity risk management process.
When should an enterprise consider Managed Security Services?
Managed Security Services may be especially relevant when an organization:
operates critical systems around the clock;
relies on websites or APIs for direct revenue;
has a small internal IT team but a large attack surface;
does not maintain an in-house 24/7 SOC;
operates multiple firewalls, endpoints, cloud environments, and SaaS platforms;
lacks the resources to build and maintain an internal SIEM or SOC;
requires defined incident-response SLAs;
has previously experienced DDoS, malware, ransomware, or other major cyber incidents.
Managed Security Services do not eliminate cybersecurity risk.
Their value lies in helping organizations detect threats earlier, mobilize the right expertise faster, coordinate response actions more effectively, and maintain monitoring after the initial crisis has been contained.
👉 For additional context, organizations can review IPSIP Vietnam’s overview of Managed Security Services providers in Vietnam
IPSIP Vietnam: supporting enterprises in DDoS response and cyber defense
A large-scale DDoS incident demonstrates that enterprises need more than security tools alone. They also require continuous monitoring capabilities, a clearly defined Incident Response process, and a team that can coordinate quickly when an incident exceeds the capacity of internal IT resources.
IPSIP Vietnam works alongside enterprises through a Managed Services model that brings together infrastructure operations, cybersecurity monitoring, and incident response support. Rather than relying on a single defensive control, organizations can develop a layered security model aligned with their actual architecture—from firewall operations and 24/7 SOC monitoring to detection, escalation, and incident-handling procedures.
Through IPSIP SOC 24/7, enterprises can strengthen continuous security monitoring, identify abnormal activity, investigate alerts, and improve coordination when cybersecurity incidents occur.
For environments that require continuous control over network traffic and perimeter security policies, Managed Firewall 24/7 can help reduce the operational burden on internal teams while supporting ongoing monitoring of firewall configurations and security events under a managed-service model.
When a DDoS attack, malware infection, or more complex cyber incident occurs, this collaborative model can help shorten the time required to validate the incident, establish the right escalation path, mobilize specialized resources, and reduce dependence on ad hoc emergency response.
For organizations currently reviewing their DDoS resilience, developing an Incident Response Plan, or looking to strengthen 24/7 cybersecurity monitoring, IPSIP Vietnam can work alongside internal IT teams to assess the current environment and develop a Managed Services model aligned with the organization’s infrastructure, risk profile, and operational requirements.
Contact IPSIP Vietnam to explore collaboration opportunities or discuss Managed Services, continuous security monitoring, and incident response solutions for your organization.
🎉To assist enterprises in optimizing risk management costs, IPSIP Vietnam is currently rolling out a special promotional program: Get an immediate 15% discount on the total contract value for all new clients signing up for Pentest services or other solution suites. Sign up for IPSIP Vietnam's Pentest services today to undergo structured testing, analysis, and comprehensive security vulnerability remediation support, maximizing the protection of your digital assets!
References
