Major events have become triggers for DDoS attacks on organisations in the host country. Summits, sporting events and song contests have all come with them. The attackers usually aim at whatever is visible and connected to the host country, rather than at the event itself.
Switzerland has seen this pattern several times in three years. During the World Economic Forum in Davos in January 2025, NETSCOUT counted more than 1,400 DDoS attacks on Swiss targets in five days, about twice the level of comparable periods in December.
The short version
- Event dates are known in advance, and so is the risk. Hacktivist groups pick dates when the world is watching, because an outage on those days gets reported.
- The host country is the target, not only the event. Around past events in Switzerland, federal websites, cantonal portals, municipalities and banks were hit, most of them with no link to the event.
- Attack volume can double. During the WEF 2025, NETSCOUT measured twice the usual number of attacks on Swiss targets, and a 426 Gbps attack the day before the forum opened.
- Switzerland starts from a high baseline. NETSCOUT logged 54,885 DDoS attacks on Swiss targets in the first half of 2026, two and a half times Austria’s 21,798, with attacks lasting more than twice as long.
- A known date is an advantage. The time before an event is enough to test, fix and test again.
Why do DDoS attacks increase around major events?
Hacktivist DDoS campaigns are built for attention. The Swiss Federal Office for Cyber Security (BACS) said so directly about the attacks during the WEF 2025: they “are aimed at attracting media attention and do not result in any data leakage.”
A major event supplies that attention ready-made. International media are already reporting, political leaders are speaking, and any outage that coincides with the event becomes part of the story. The attackers do not need to reach the event’s own systems. A slow government website or a bank login page that fails during the event week is reported in the same breath.
The motive is usually political. The group that claimed most of the attacks in Switzerland, the pro-Russian collective NoName057(16), has repeatedly named a speech or a guest as its reason. In January 2024 it cited Ukrainian President Zelensky’s attendance at the WEF.
What the record shows
The pattern is not specific to one country or one type of event. France’s cyber agency ANSSI counted 548 cybersecurity events affecting entities linked to the Paris 2024 Olympic and Paralympic Games between May and September 2024. Nearly half of them were cases of services becoming unavailable, with DDoS attacks among the causes.
In Switzerland, the Swiss authorities have registered the following main cases of attacks:
- June 2023, Zelensky’s video address to the Federal Assembly. From 7 to 19 June 2023, Swiss domains including the parliament’s website were hit by DDoS attacks, according to the Office of the Attorney General. In July 2025 it issued arrest warrants for three suspected key members of NoName057(16).
- January 2024, WEF in Davos. On 17 January 2024 a DDoS attack temporarily disrupted access to several federal administration websites. The BACS had warned critical infrastructure operators a week earlier.
- June 2024, Summit on Peace in Ukraine at the Bürgenstock. The BACS coordinated a cyber situation network of almost 100 experts. It attributed the attacks to NoName057(16) and reported that they “caused only minor disruption to IT infrastructures“.
- January 2025, WEF in Davos. The BACS confirmed DDoS attacks on Swiss websites in connection with the forum. Swiss media named the Zurich and Vaud cantonal banks and cantonal and municipal websites among those affected.
- May 2025, Eurovision Song Contest in Basel. On 16 May 2025 the BACS reported that DDoS attacks on Swiss websites connected to the contest had begun.
- June 2026, G7 summit in Évian, France. Ahead of the summit, the BACS said it expected “disruptive cyberoperations during the G7, particularly distributed denial-of-service (DDoS) attacks targeting Swiss organisations“. The event took place across the border, but Swiss organisations were still on the list.
The BACS now publishes this kind of advisory ahead of large events as a matter of routine, which says something about how predictable the pattern has become.
One example up close: the WEF 2025
NETSCOUT’s ASERT team published a detailed breakdown of the forum week. Between 20 and 24 January 2025 it observed more than 1,400 DDoS attacks against Swiss targets, roughly double the level of comparable December periods. The largest, on 19 January, hit a major Swiss service provider network at 426 Gbps.
The attackers also changed method from day to day. It started with DNS reflection amplification, moved to a mix of reflection vectors, then to mostly TCP-based attacks and DNS query floods, and finally to TCP SYN floods and SYN/ACK amplification. A defence tuned for the first wave can sit idle while the third one gets through.
The outcome was still mostly a nuisance rather than an outage. In its semi-annual report for the first half of 2025, BACS says targeted prevention and defence measures averted significant impact during both the WEF and the Eurovision Song Contest. Preparation made the difference.
How high is the DDoS baseline in Switzerland?
Event spikes land on a level that is already high. NETSCOUT’s ATLAS telemetry for January to June 2026 shows how Switzerland compares with its DACH neighbours:
- Switzerland: 54,885 DDoS attacks, average duration 121.6 minutes.
- Austria: 21,798 attacks, average duration 42.3 minutes.
- Germany: 277,080 attacks, average duration 51.0 minutes.
Austria has a population similar to Switzerland’s and saw fewer than half as many attacks. Germany has roughly nine times as many inhabitants and saw only about five times as many attacks. Per head, Switzerland is the most heavily targeted of the three, and its attacks last more than twice as long.
The most targeted Swiss sectors in that period were wireless carriers (29,638 attacks) and wired carriers (17,067), followed by hosting and data processing providers. That matters for everyone else: a bank’s DDoS protection often depends on a carrier or hosting provider that is itself under fire during the same week.
The global trend points the same way. NETSCOUT’s report for the first half of 2026 counts more than 9.1 million attacks worldwide, a 1,286% year-on-year increase in attacks above 1 Tbps or 1 Gpps, and residential proxy networks contributing attack traffic from ordinary consumer IP addresses.
How to prepare your DDoS defences before a major event
An institution with a DDoS protection contract usually believes it is covered. An event week is when that belief gets finally tested. The four questions below are worth answering beforehand.
1. Who absorbs the volumetric traffic, and how fast?
Reflection and amplification attacks like those NETSCOUT saw during the WEF are a bandwidth problem, and bandwidth is solved upstream by your carrier or scrubbing provider. Confirm the contract covers the services that matter, how mitigation is activated, and who calls whom when it does not trigger on its own.
2. Does the application layer hold under realistic traffic?
Volumetric scrubbing does little against requests that look legitimate. Floods of well-formed HTTP requests, slow connections that tie up server workers and full TLS handshakes that burn CPU all pass the network edge by design. Whether your WAF, rate limits, load balancer and application cope with them can only be answered by a test against your own infrastructure. Our taxonomy of DDoS attack types explains which controls see which kind of attack.
3. Is there a process to act upon warnings?
Dashboards that turn red in an unwatched channel do not count. During an event week, alerting, escalation paths and on-call cover should be tested and staffed, with a clear decision on who is allowed to switch mitigation modes.
4. Can you prove it afterwards?
For FINMA-supervised institutions, the expectations of Circular 2023/1 on operational risks and resilience do not pause for an event week. A documented test, run beforehand, is evidence.
Why a single-source test gives the wrong answer
Many organisations check their protection with a load test from one location or a handful of cloud servers. The result is reassuring but can be misleading. Per-IP rate limits, bot detection and IP reputation all catch a single source within seconds, so the defence looks strong.
A hacktivist botnet, or traffic routed through residential proxies, does not look like that. It arrives from thousands of addresses in many countries at once, each sending a modest number of requests. The controls that blocked the single-source test may never trigger.
DDoS attacks around a major event are not a surprise. The date is in the calendar and the authorities warn about it every time. The open question is whether your defences have been tested before someone else tests them.
How Obsidio tests resilience
Obsidio runs controlled, authorized DDoS simulations against your own infrastructure from a real distributed devices network using hardware and smartphones, not datacenter IPs. That makes the traffic look like the distributed attacks that arrive around major events, something a single-source test cannot reproduce.
Nothing runs until you prove ownership of the target through a DNS TXT record. You choose one of ten simulation types, grouped into application-layer floods, slow attacks, connection exhaustion and protocol-specific or scripted tests, then set scale, geography and duration. Most institutions start in a controlled window with conservative limits and ramp up, and live metrics let you abort instantly.
The result is a report mapped to FINMA, DORA and NIS2. It shows which parts of the chain held and where the service degraded, so the gaps can be closed before the event rather than during it. The internal side, whether your SIEM fired and whether on-call was paged, lives on your own consoles, so somebody should be watching them during the test window too.
Volumetric reflection and amplification attacks are not part of what Obsidio simulates. Those belong to your carrier and scrubbing provider, which is why question 1 above is about the contract, not a test. Our guide on how to test your DDoS protection covers how the pieces fit together.
The next date is already in the calendar
Major events are scheduled months ahead, and the next WEF Annual Meeting is set for 18 to 22 January 2027. That leaves enough time to run the simulations in a quiet window, fix what fails, and run them again before the event week starts.
To plan a resilience test ahead of an event, contact us or write to [email protected].