Attackers increasingly favored brief network disruptions under 10 minutes in duration, causing these sub-gigabit events to surge across the third quarter. While coordinated takedowns sharply curtailed record-setting volumetric attacks, Mirai-based infrastructure continued to generate nearly half of all network-layer traffic mitigated by Cloudflare. Threat actors also abandoned specific vectors like CLDAP floods in favor of DNS amplification and generic UDP vectors to sustain high incident counts. Defenses faced relentless pressure, with Cloudflare handling an average of 8,226 network-layer incidents every hour.
Key points
The United States overtook China as the most targeted nation as overall regional aggressi…: The United States overtook China as the most targeted nation as overall regional aggression also spiked against Canada and Israel.
Adversaries shifted attack vectors by abandoning CLDAP floods and driving a 215 percent s…: Adversaries shifted attack vectors by abandoning CLDAP floods and driving a 215 percent surge in DNS amplification alongside broader UDP attacks.
Sector targets expanded significantly beyond traditional media victims to hit consumer se…: Sector targets expanded significantly beyond traditional media victims to hit consumer services, internet infrastructure, software, adult entertainment, and gambling.
Sources checked by our analysis pipeline: 1
Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One, Cloudflare's Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network.
Key insights
- Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure.
- Threat actors dramatically shifted their reflection and amplification tactics, abruptly abandoning CLDAP floods, which collapsed by 99.5% quarter-over-quarter. Instead, attackers pivoted heavily toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods.
Developer Tom Anthony built an alternative platform called YourOwnWeigh to help smart scale owners retain control over their personal health metrics. The tool emerged in direct response to manufacturer policy shifts requiring new customers to pay recurring fees to export measurements to outside apps. By rerouting scale traffic to independent cloud setups, users can completely circumvent proprietary cloud services and bloated native software.
Leadership is offering voluntary exit packages to roughly a quarter of the global workforce across four countries through December. The move serves Chief Executive Officer Satya Nadella's strategy to curtail personnel expenses while redirecting critical capital into advanced artificial intelligence systems. This strategic restructuring follows recent targeted workforce reductions and marks the company's first year-over-year operational contraction in a decade.
American intelligence agencies reportedly monitored an associate linked to Singapore-based cloud provider Megaspeed over concerns of Chinese espionage leveraging access to President Trump. The scrutiny surfaces as Washington policymakers intensify efforts to keep advanced artificial intelligence chips away from Beijing's commercial and military sectors. In response, the semiconductor maker affirmed that its routine commercial interactions never compromise trade secrets or national security data.