A distributed denial-of-service (DDoS) attack targeting a bank in Cyprus lasted 200 hours during the third quarter of 2026, highlighting the growing threat of prolonged cyberattacks against the financial sector, according to cybersecurity company Qrator Labs.
The attack continued for more than eight days, making it significantly longer than any incident recorded by the company in 2025 and more than 2.5 times the duration of the longest attack observed in the previous quarter.
The findings underline the importance of ensuring that critical financial services remain operational during sustained cyber disruptions.
Financial technology remains the main target
Qrator Labs’ latest global report found that financial technology (fintech) was the most targeted sector during the third quarter, accounting for 31.3% of all recorded DDoS attacks.
E-commerce followed with 19%, while information and communication technology accounted for 18.2%. Together, the three sectors represented more than two-thirds of the incidents recorded.
The findings are particularly relevant to Cyprus, which has developed into a hub for online trading, brokerage and financial services. Companies operating in these areas face growing expectations to demonstrate that their systems can withstand serious cyber incidents and recover effectively.
DORA puts focus on financial sector resilience
The findings come amid increased regulatory attention to operational resilience and compliance with the European Union’s Digital Operational Resilience Act (DORA), which establishes requirements for financial firms to manage information and communication technology risks.
At the sixth Cyber Security Conference in September 2026, Christos Meletiou of the Central Bank of Cyprus stressed that financial institutions must go beyond formal compliance with DORA and demonstrate that their security and recovery arrangements work in practice.
Also in September, the Cyprus Securities and Exchange Commission (CySEC) introduced new reporting requirements under DORA.
The requirements apply to investment firms, crypto-asset service providers, trading venues and other regulated financial entities experiencing major information and communication technology incidents.
Affected firms must calculate and report the resulting annual costs and losses to the regulator, requiring them to quantify the financial impact of serious disruptions and maintain effective response arrangements.
Botnet size increases by 70%
The scale of DDoS attacks is also growing.
Qrator Labs reported that the largest botnet it observed during the third quarter consisted of 3.56 million devices, an increase of around 70% from 2.09 million in the second quarter.
A botnet is a network of compromised devices controlled remotely by attackers and used to overwhelm websites, applications and other online services with traffic, potentially making them unavailable to legitimate users.
The latest increase followed a sharp decline earlier in the year, after an international law enforcement operation targeted major botnets. However, the rapid rebound suggests that the disruption may have had only a temporary effect.
Attackers can rebuild networks within months
Qrator Labs Chief Technology Officer Andrey Leskin said financial institutions were particularly attractive targets because they handled money, but warned that cybercriminals did not necessarily distinguish between different business models.
“Even a payment provider that simply processes transactions and earns a commission may be perceived as a lucrative target,” he said.
Leskin added that DDoS attacks were often used for extortion but could also serve as a distraction, allowing attackers to conceal intrusions and prevent security teams from responding in time.
He warned that even when international law enforcement operations disrupted major botnets, their operators could rebuild the infrastructure within months.
“Millions of poorly secured connected devices remain available for attackers to exploit because they receive few or no security updates, and AI tools are making it increasingly easy to compromise them at scale,” he said.
“As long as attackers can exploit these devices to rebuild their networks, financial institutions must be prepared for prolonged and potentially repeated attacks,” Leskin added.
Financial institutions face growing resilience demands
The report suggests that disrupting individual botnets may not provide a lasting solution, as attackers can assemble new networks using vulnerable devices that remain connected to the internet.
For financial organisations, the challenge is therefore not limited to preventing attacks. They must also ensure that essential services remain available when disruptions continue for extended periods or recur after systems have been restored.
Qrator Labs said the findings reinforced the need to treat DDoS protection as part of wider operational resilience, with financial institutions focusing on maintaining critical services during sustained attacks rather than concentrating solely on preventing individual incidents.
Also read: Deputy Minister to promote Cyprus as regional centre for innovation in California
For more videos and updates, check out our YouTube channel
