Source: cyprus-mail
Cyprus financial sector faces growing threat from prolonged cyberattacks
Financial institutions in Cyprus face growing risks from prolonged cyberattacks, after a distributed denial-of-service (DDoS) attack targeting a bank lasted 200 hours in the third quarter of 2026, according to cybersecurity company Qrator Labs, highlighting the importance of keeping critical digital services operational during sustained disruptions.
The attack lasted more than 8 days, making it significantly longer than any incident recorded by the company during 2025 and more than 2.5 times the duration of the longest attack observed in the previous quarter.
Qrator Labs’ latest global report found that financial technology (fintech) remained the most targeted sector, accounting for 31.3 per cent of all recorded DDoS attacks during the third quarter.
E-commerce followed with 19 per cent of attacks, while information and communication technology accounted for 18.2 per cent, meaning the 3 sectors together represented more than two-thirds of the incidents observed.
The findings are particularly relevant to Cyprus, which has established itself as a hub for online trading, brokerage and financial services, with firms increasingly expected to demonstrate that their systems can withstand serious cyber incidents and recover effectively.
The report comes amid growing regulatory attention to operational resilience and compliance with the European Union’s Digital Operational Resilience Act (DORA), which sets requirements for financial firms to manage information and communication technology risks.
At the 6th Cyber Security Conference in September 2026, Christos Meletiou of the Central Bank of Cyprus stressed that financial institutions must go beyond formal compliance with DORA and demonstrate that their security and recovery arrangements work in practice.
Also in September, the Cyprus Securities and Exchange Commission (CySEC) introduced new reporting requirements under DORA, requiring investment firms, crypto-asset service providers, trading venues and other regulated financial entities experiencing major information and communication technology incidents to calculate and report the resulting annual costs and losses.
The rules require affected firms to quantify the financial impact of serious disruptions and submit the findings to the regulator, adding to the pressure on institutions to understand the consequences of incidents and maintain effective response arrangements.
The scale of DDoS attacks is also increasing, with Qrator Labs reporting that the largest botnet it observed reached 3.56 million devices in the third quarter, up by around 70 per cent from 2.09 million in the second quarter.
A botnet is a network of compromised devices that attackers can control remotely and use to overwhelm websites, applications and other online services with traffic, potentially making them unavailable to legitimate users.
The latest increase followed a sharp decline earlier in the year after an international law enforcement operation targeted major botnets, but the rapid rebound suggests the disruption may have had only a temporary effect.
“Financial institutions are particularly attractive to cybercriminals because they deal with money. But attackers rarely distinguish between business models. Even a payment provider that simply processes transactions and earns a commission may be perceived as a lucrative target,” said Andrey Leskin, chief technology officer at Qrator Labs.
“DDoS attacks are often used for extortion, but they can also serve as a distraction, allowing attackers to conceal intrusions and prevent security teams from responding in time,” he added.
Leskin stated that the ability of attackers to rebuild their infrastructure posed a further challenge, even when law enforcement agencies managed to disrupt large networks.
“Even when international law enforcement efforts, which remain few and far between, disrupt major botnets, their operators can rebuild the infrastructure within months,” he said.
“Millions of poorly secured connected devices remain available for attackers to exploit because they receive few or no security updates, and AI tools are making it increasingly easy to compromise them at scale,” he added.
“As long as attackers can exploit these devices to rebuild their networks, financial institutions must be prepared for prolonged and potentially repeated attacks,” Leskin stressed.
The report’s findings suggest that disrupting individual botnets may not provide a lasting solution, as attackers can assemble new networks using vulnerable devices that remain connected to the internet.
For financial organisations, the challenge is therefore not limited to preventing attacks, but also ensuring that essential services remain available when attacks continue for extended periods or recur after systems have been restored.
Qrator Labs said these trends reinforced the need to treat DDoS protection as part of wider operational resilience, with financial institutions focusing on their ability to maintain critical services during sustained attacks rather than concentrating solely on preventing individual incidents.