Cloudflare DDoS Report: Short-Burst Attacks Surge, Hyper-Volumetric Declines in Q3 2026
Cloudflare's Q3 2026 DDoS Threat Report indicates a significant shift towards shorter, lower-bandwidth attacks, while massive volumetric assaults have decreased, potentially due to law enforcement actions against major botnets.
Cloudflare's latest Distributed Denial of Service (DDoS) Threat Report for the third quarter of 2026 reveals a dramatic increase in short-burst, low-bandwidth attacks, which surged by 208%. These attacks, typically lasting under 10 minutes and staying below 1 Gbps, are characteristic of DDoS-for-hire services and primarily targeted the computer software, gambling, and information technology sectors. This trend marks a significant operational shift for threat actors.
Conversely, the report highlights a substantial decline of nearly 69% in hyper-volumetric attacks exceeding 1 Tbps. This decrease is strongly correlated with successful law enforcement actions earlier in the year that dismantled four major Internet of Things (IoT) botnets: Aisuru, KimWolf, JackSkid, and Mossad. Despite this reduction in large-scale attacks, IoT botnets remain a persistent threat, with new variants like Dysphoria and Evooo1Bot continuing to emerge and contribute to network-layer traffic.
Attackers have also significantly altered their preferred amplification and reflection tactics. CLDAP floods, which saw a massive surge in the first half of the year, collapsed by 99.5% in Q3. In their place, threat actors pivoted heavily towards other connectionless protocols. DNS amplification attacks saw a 215% surge, and general UDP floods increased by 122%. These methods exploit open DNS resolvers and the connectionless nature of UDP to overwhelm targets with amplified responses.
The geographical and industrial scope of DDoS attacks has also broadened. The United States reclaimed its position as the most-attacked country, while Canada and Israel experienced notable spikes in targeted activity, coinciding with geopolitical and domestic events. The focus of attacks shifted away from media organizations towards a more diverse range of industries, including consumer services, internet infrastructure, and adult entertainment.
Across its global network, Cloudflare mitigated approximately 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP DDoS requests during Q3 2026. This equates to an average of 8,226 network-layer attacks per hour, or one attack every 0.44 seconds. The total mitigated traffic reached 272.6 petabytes at the network layer and 95.1 petabytes at the HTTP layer.
While large-scale botnets faced disruption, the underlying threat from IoT devices persists. Mirai-classified attacks, for instance, peaked in August, accounting for a significant portion of mitigated network-layer bytes. The longest sustained Mirai attack observed during the quarter lasted nearly 50 hours, underscoring the resilience of these botnets even after major takedowns.
The report underscores a dynamic threat landscape where attackers rapidly adapt their methodologies in response to law enforcement actions and evolving infrastructure. The shift towards shorter, more frequent attacks suggests a strategy focused on saturation and disruption rather than prolonged, high-impact assaults, requiring continuous vigilance and adaptive defense mechanisms from organizations.