Shifts in the cybersecurity threat landscape have turned consumer devices into a collective national security risk, as the network of exploitable devices surges past 200 million, Nokia’s research has shown. Statistics released by Nokia's Deepfield Emergency Response Team (ERT) revealed that internal army of weaponized subscriber devices, including smartphones, routers, and IoT gear is outpacing traditional cybersecurity defenses, a trend being further fueled by AI scraping. According to the report, 77% of all distributed denial of service (DDoS) attacks now end within five minutes, with 37% concluding in under two minutes. This rapid-fire timeline makes legacy detect-and-divert security playbooks obsolete. The Nokia report highlighted how modern DDoS attacks have evolved from prolonged external floods into complex, internal bursts, with 58% of incidents being multivector attacks, combining multiple methods (such as SYN floods and HTTP layer-seven attacks) to bypass single-signature defenses. The data also showed that 52% of attacks use "carpet bombing" tactics, spreading traffic across multiple destination prefixes to slip under conventional detection thresholds. Telecom providers have historically operated on a predictable playbook, defending against external traffic originating from overseas hosting environments. However, Nokia warns that infrastructure approaches have broken down over the past year. The vendor points to the multihundred-million-dollar residential proxy market as the hidden engine behind this shift. Often, middlemen pay app developers to embed proxy software development kits (SDKs) into ordinary applications, while some device manufacturers have shipped malware directly within factory firmware. However, the primary financial engine backing this infrastructure is legitimate, Nokia says. Massive AI companies require large amounts of data for large language model (LLM) training and inference. For instance, one leading proxy vendor publicly stated that 14 of the top 20 LLM companies are its customers. The report pointed to premium rates for residential IP addresses to scrape the web, with a