Cyber attack kits that can knock company websites offline are being sold on the dark web for as little as $1, or about R16.50, according to new research by cybersecurity company Kaspersky.
Subsea cable operator Seacom said a single distributed denial-of-service (DDoS) attack can cost a South African company up to R2.5 million. This includes lost income, downtime and the cost of fixing the damage.
“DDoS attacks have become a more practical and accessible option for threat actors, largely because these services are cheap and easy to obtain,” said Kaspersky analyst João Brandão.
“In some cases, the cost of launching an attack can be lower than a standard monthly streaming subscription, or even the price of a cup of coffee,” Brandão said.
A DDoS attack floods a website or network server with huge amounts of fake web traffic in a short time. Attackers often use botnets, which are networks of hijacked computers, to send this traffic.
Kaspersky said the kits are sold on dark web sites and in hacker communities. Prices start at R16.50 but depend on the target, how long the attack runs, the features and service limits. Some kits sell for up to R30,000.
The company said selling DDoS attacks as a service is a growing business. It counted more than 256,000 posts about DDoS on hidden dark web sites and platforms since at least 2024.
Kaspersky experts studied how these services are priced and marketed. They also looked at how competition between sellers changed the market over time.
The research found three main types of attack. In the first, a person hires a third party on the dark web to attack a chosen target. Payments are often hidden using cryptocurrencies.
The second type is DDoS as a service. “Users buy subscriptions to attack tools such as online control panels or Telegram bots,” Kaspersky said.
These ready-made tools are installed on a local computer and come with instructions to run attack scripts. The buyer does not need to know how to write code or build a botnet.
In the third type, attackers run the attacks themselves. Kaspersky said the reasons vary. An attack can hide a hack, be used to demand money from victims, or be an act of revenge.
South Africa saw a week-long DDoS attack in May 2026, which started on or around 18 May. Several large websites, web hosting companies and network operators were hit.
Users reported problems reaching services such as SARS eFiling and news websites including News24 and BusinessTech. Web host 1-Grid said one attack on its network was larger than 100 Gbps.
Industry sources said Host Africa, Diamatrix, Liquid Intelligent Technologies and Network Platforms were targeted at the same time. Seacom later said it was also hit.
“This was not due to any failure of Seacom’s infrastructure, but rather the result of targeted malicious traffic, with wider ecosystem impact,” Seacom said at the time.
At its peak, operators were flooded with traffic of 1 Tbps. Messages claiming to be from the attackers asked for money to stop the attacks, but the origin and motive have not been confirmed.
Using these kits is a crime under South Africa’s Cybercrimes Act. People found guilty of DDoS attacks on local systems can face fines or five to 10 years in prison.
Source: this article is based on reporting by MyBroadband. Image: MyBroadband. Written with the help of AI and published by the Tzaneen Voice Business desk. See our Editorial Standards.
Anelisa Nkuna covers business and money news for Tzaneen Voice. Anelisa reports on the rand, fuel prices, interest rates, jobs, Eskom, Transnet, farming and company results. The aim is simple: explain what the numbers mean for household budgets, small businesses and workers in South Africa.