{"id":35331,"date":"2026-04-02T08:00:00","date_gmt":"2026-04-02T08:00:00","guid":{"rendered":"https:\/\/globalcyberalliance.org\/?p=35331"},"modified":"2026-04-02T08:00:10","modified_gmt":"2026-04-02T08:00:10","slug":"les-cyberattaques-contre-la-france-augmentent-voici-ce-que-revelent-les-donnees-de-laide","status":"publish","type":"post","link":"https:\/\/globalcyberalliance.org\/fr\/les-cyberattaques-contre-la-france-augmentent-voici-ce-que-revelent-les-donnees-de-laide\/","title":{"rendered":"Les cyberattaques contre la France augmentent \u2014 Voici ce que r\u00e9v\u00e8lent les donn\u00e9es de l’AIDE"},"content":{"rendered":"\n

Executive Summary<\/h2>\n\n

The Global Cyber Alliance was recently asked about the surge of cyberattacks affecting France and if we see evidence that French infrastructure is being attacked more than before.\u00a0<\/p>\n\n

We analyzed events observed through GCA’s AIDE platform<\/a>, which provides visibility into large-scale distributed attack activity, including automated scanning, exploitation attempts, botnet propagation, infrastructure concentration, and repeated targeting patterns.<\/p>\n\n

Studying data from May 2025 to February 2026, we saw an approximately\u00a0threefold increase in attacks targeting French networks<\/strong>\u00a0and\u00a0a distinct surge in attacks originating from French infrastructure<\/strong>\u00a0in December 2025. Malware signatures are consistent with Mirai-family botnet activity.<\/p>\n\n

Taken together, the data indicated sustained and growing pressure on France-facing infrastructure, consistent with\u00a0broader industry observations of increased botnet-driven activity<\/a>\u00a0during this period. These external assessments do not constitute direct confirmation of activity observed in AIDE telemetry.<\/p>\n\n

This article includes data and charts that illustrate the key patterns observed in AIDE telemetry, highlighting trends in attack volume, infrastructure distribution, and persistence of activity targeting France-based sensors.<\/p>\n\n

External Reporting and Corroboration of Attacks<\/h2>\n\n

Cyber activity affecting French entities has been documented by French authorities and external cybersecurity reporting, including\u00a0ANSSI assessments of state-linked targeting<\/a>\u00a0and public reporting on\u00a0disruptive attacks affecting French infrastructure<\/a>.<\/p>\n\n

Public reporting from 2024 through early 2026 reflects two distinct trends:\u00a0targeted intrusions affecting French government and institutional networks<\/a>, and broader\u00a0high-volume botnet or DDoS activity<\/a>\u00a0affecting French-facing infrastructure.<\/p>\n\n

Separate\u00a0industry reporting has also documented continued use of Mirai-family malware<\/a>\u00a0in large-scale scanning, exploitation, and DDoS campaigns, providing useful context for interpreting distributed attack activity observed in telemetry.<\/p>\n\n

What We See in AIDE Data<\/h2>\n\n

Analysis of AIDE telemetry showed two distinct France-related patterns.<\/p>\n\n

First, attacks targeting France-based AIDE sensors increased from baseline levels of 400K\u2013500K monthly events (May\u2013August 2025) to over 1.3M in February 2026, representing an approximately\u00a03x increase<\/strong>, with a steadily rising trend over the study period. A small set of IPs show sustained activity, repeatedly targeting France-based sensors across multiple consecutive months, indicating\u00a0persistent infrastructure<\/strong>\u00a0rather than one-off events.<\/p>\n\n

Second, attacks originating from French infrastructure and observed by AIDE sensors elsewhere showed a\u00a0distinct surge<\/strong>\u00a0in December 2025, peaking at over 1.3M hits before declining in subsequent months.<\/p>\n\n

Malware signatures are consistent with\u00a0Mirai-family botnet activity<\/strong>, including variants linked to large-scale distributed campaigns (for example, LZRD, SORA, and related strains).<\/p>\n\n

From an infrastructure perspective, attack traffic targeting France-based sensors is broadly distributed across\u00a0residential and access networks<\/strong>\u00a0(Cable\/DSL\/ISP at approximately 30%) and network service providers (NSPs) (approximately 18%), with a large unattributed segment (approximately 37%). However,\u00a0peak attack volumes are typically driven by a smaller set of hosting providers<\/strong>, indicating a distinction between distributed activity and concentrated high-intensity sources.<\/p>\n\n

The charts below illustrate the key patterns we saw in AIDE telemetry, highlighting trends in attack volume, infrastructure distribution, and persistence of activity targeting France-based sensors.<\/p>\n\n

1. Sustained Growth in Targeting France-Based Sensors<\/h2>\n\n
\"Traffic<\/figure>\n\n

Monthly attack volume increased from 400K\u2013500K to over 1.3M by February 2026, showing a steady upward trend that peaked in February. This growth is driven primarily by unwanted traffic (attacks).<\/p>\n\n

2. France as a Source: Outbound Attack Activity<\/h2>\n\n
\"Outbound<\/figure>\n\n

Activity originating from French infrastructure shows a distinct spike in December 2025, reaching over 1.3M hits before dropping sharply in January. Unlike the sustained upward trend observed in attacks targeting France-based sensors, this pattern is short-lived and concentrated, indicating a burst of high-volume activity from French networks rather than persistent growth. In some cases, such outbound spikes can reflect compromised or infected devices within weaker or exposed infrastructure being leveraged as sources of attack traffic.<\/p>\n\n

3. Geographic Distribution of Attack Infrastructure Targeting AIDE France Sensors<\/h2>\n\n
\"Top<\/figure>\n\n

Attack traffic targeting France is concentrated in a small number of infrastructure hubs. The Netherlands alone accounts for 33.5% of activity, with Vietnam and Germany contributing an additional 29% combined, while France itself represents only 1.5% of inbound traffic.<\/p>\n\n

4. Infrastructure Types<\/h2>\n\n
\"Two<\/figure>\n\n

Attacks are widely distributed across ISP and NSP networks, but high-volume activity is concentrated in a smaller set of hosting infrastructure.<\/p>\n\n

5. Persistent Infrastructure Targeting France Sensors<\/h2>\n\n
\"Persistent<\/figure>\n\n

A small set of IPs repeatedly target France-based sensors across multiple consecutive months, indicating persistent infrastructure rather than one-off activity. This sustained presence is consistent with coordinated botnet operations maintaining access and continuously executing attacks over time.<\/p>\n\n

6. Mirai-like Activity Observed via Payload Analysis<\/h2>\n\n

Payload analysis and VirusTotal enrichment confirm that the observed activity is consistent with Mirai-family botnet operations. Multiple Mirai variants, including LZRD, Cult, SORA, and related strains, were identified across attack sessions. Detection labels consistently map to known Mirai behaviors such as automated scanning, payload downloaders, and DDoS-enabled botnet recruitment, reinforcing that the activity represents coordinated, large-scale botnet campaigns.<\/p>\n\n

Representative detection labels include:\u00a0<\/p>\n\n