Cloudflare Report: 1 Tbps DDoS Attacks Surge 519% Amidst Geopolitical Tensions
Cloudflare's H1 2026 DDoS Threat Report highlights a dramatic 519% increase in attacks exceeding 1 Tbps, with DNS floods dominating network-layer vectors and geopolitical events influencing targeted sectors.
Cloudflare's latest DDoS Threat Report for the first half of 2026 reveals a startling escalation in the scale and nature of distributed denial-of-service attacks. The report, compiled by Cloudflare's Threat Intelligence organization, indicates a 519% quarter-over-quarter surge in network-layer DDoS attacks that surpassed the 1 Tbps threshold between Q1 and Q2 2026. This dramatic growth signifies a new era of hyper-volumetric assaults, stressing even the most robust internet infrastructure.
The primary attack vector has also shifted, with DNS-based attacks now accounting for a significant portion of network-layer activity. DNS Floods alone saw their share climb from 25.7% to 40.0% of network-layer attacks in Q2, while CLDAP Floods surged by 580% to become the third most prevalent vector. This shift away from traditional botnet floods towards reflection and amplification techniques presents new challenges for defenders.
Geopolitical events and global tensions have demonstrably influenced the targets of these attacks. The Media, Production & Publishing industry remained the most frequently targeted sector, likely due to ongoing coverage of conflicts in Iran and Ukraine, as well as major sporting events like the World Cup. Concurrently, Turkey emerged as the third most attacked country, coinciding with the NATO Summit in Ankara, and the Government sector saw a significant jump from 29th to 9th place in attack rankings during Operation Epic Fury, a series of strikes against Iran.
Operation PowerOFF, a multi-national law enforcement initiative targeting over 75,000 DDoS-for-hire users, may have contributed to a peak in DDoS activity observed in April 2026. This peak saw trillions of requests and petabytes of data traffic, equivalent to years of continuous 4K video streaming. While the operation's impact is still being assessed, the subsequent decline in activity suggests a potential correlation.
Despite the headline-grabbing hyper-volumetric attacks, the report emphasizes that the median DDoS attack remains relatively short-lived and small in scale. Over 96% of network-layer attacks were under 500 Mbps, and 90% concluded in under 10 minutes. However, even these smaller attacks can be sufficient to overwhelm unprotected servers or websites, underscoring the need for constant vigilance.
The report also touches on the complexity of modern attacks, noting that attackers sometimes blend layers, combining high packet rates with lower bandwidth or vice versa to exploit different network vulnerabilities. The brief duration of most attacks, often lasting mere seconds, means manual intervention is impractical, highlighting the necessity of automated, always-on DDoS protection solutions.
In summary, the first half of 2026 has been characterized by an unprecedented surge in large-scale DDoS attacks, a shift in attack vectors towards DNS-based methods, and a clear influence of global geopolitical events on targeting. The findings underscore the evolving threat landscape and the critical need for advanced, automated defenses.