Shifts in the cybersecurity threat landscape have turned consumer devices into a collective national security risk, as the network of exploitable devices surges past 200 million, Nokia’s research has shown.

Statistics released by Nokia's Deepfield Emergency Response Team (ERT) revealed that internal army of weaponized subscriber devices, including smartphones, routers, and IoT gear is outpacing traditional cybersecurity defenses, a trend being further fueled by AI scraping.

According to the report, 77% of all distributed denial of service (DDoS) attacks now end within five minutes, with 37% concluding in under two minutes. This rapid-fire timeline makes legacy detect-and-divert security playbooks obsolete.

The Nokia report highlighted how modern DDoS attacks have evolved from prolonged external floods into complex, internal bursts, with 58% of incidents being multivector attacks, combining multiple methods (such as SYN floods and HTTP layer-seven attacks) to bypass single-signature defenses.

The data also showed that 52% of attacks use "carpet bombing" tactics, spreading traffic across multiple destination prefixes to slip under conventional detection thresholds.

Telecom providers have historically operated on a predictable playbook, defending against external traffic originating from overseas hosting environments. However, Nokia warns that infrastructure approaches have broken down over the past year.

The vendor points to the multihundred-million-dollar residential proxy market as the hidden engine behind this shift. Often, middlemen pay app developers to embed proxy software development kits (SDKs) into ordinary applications, while some device manufacturers have shipped malware directly within factory firmware.

However, the primary financial engine backing this infrastructure is legitimate, Nokia says. Massive AI companies require large amounts of data for large language model (LLM) training and inference. For instance, one leading proxy vendor publicly stated that 14 of the top 20 LLM companies are its customers.

The report pointed to premium rates for residential IP addresses to scrape the web, with a single U.S. tier-one mobile IP retailing for roughly $95 for two weeks. This AI data demand has effectively funded the world’s largest compromised device footprint.

Nokia warns that if the compromised devices across major U.S. carriers were marshaled simultaneously, the aggregate firepower would exceed hundreds of terabits per second. A strike of that scale is capable of disrupting internet connectivity for entire countries, moving the DDoS threat firmly into national security territory.

Operational toll on carriers

This internal warfare is feared to deal severe collateral damage to internet service providers long before the malicious traffic reaches its intended target.

The report indicated that multiterabit outbound flows choke cellular radio access networks (RAN) and backhaul capacity, triggering unexplained performance drops for legitimate users.

At the same time, mobile IP addresses are being flagged with maximum risk scores on third-party security engines, forcing innocent subscribers to face constant CAPTCHA challenges, declined payment cards, and throttled content.

Nokia also warned of a severe mitigation gap emerging because modern attacks peak in one to three minutes and completely disappear within five, meaning legacy systems can’t usually redirect traffic fast enough to counter the blow.

Another DDoS attack-focused report released in February showed that DDoS attacks continued to rise, with attackers eyeing UltraDNS as a surface.

DigiCert’s 2025 Radar Brief revealed that attacks targeting UltraDNS – cloud-hosted DNS services designed to securely guide user query responses for enterprises – soared in late 2025, with some 176 events spotted in December alone.

Figures suggested that UltraDNS processed some 4.75 trillion authoritative queries that same month. DDoS attacks in general increased in frequency, scale, and duration during the final three months of last year, as an already worrying trend of increased attacks continues.