Do Son 
Image: CloudFlare
TL;DR
Automated defenses blocked 18.2 million network-layer attacks and 14.4 trillion HTTP requests between July and September 2026, according to the latest Cloudflare DDoS report. While hyper-volumetric strikes dropped after police dismantled major botnets, the Cloudflare DDoS report Q3 2026 highlights a 208% surge in short-burst attacks. Furthermore, threat actors abandoned CLDAP floods in favor of DNS amplification and raw UDP traffic.
What Happened in Q3 2026
Between July and September 2026, Cloudflare mitigated an average of 8,226 network-layer attacks every hour, or one attack every 0.44 seconds. According to the 26th edition of the Cloudflare DDoS report produced by Cloudforce One, mitigated traffic reached 272.6 petabytes at the network layer and 95.1 petabytes at the HTTP layer. Most notably, short-burst attacks lasting under 10 minutes and staying below 1 Gbps jumped by 208% year-over-year.
“96% ended in under 10 minutes,” the researchers noted, adding that “98% stayed under 1 Gbps, more than enough to overwhelm a server or website.” Conversely, hyper-volumetric attacks exceeding 1 Tbps fell by nearly 69%, dropping from 805 incidents in Q2 to 251 in Q3. This decline followed early 2026 law enforcement operations that dismantled four major IoT botnets: Aisuru, KimWolf, JackSkid, and Mossad.
Protocol Shifts From CLDAP to UDP
Attackers also changed their reflection and amplification methods during the third quarter. After surging in the first half of the year, CLDAP floods collapsed by 99.5% to represent just 0.05% of all incidents. “Instead, attackers pivoted heavily toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods,” Cloudforce One reported. By spoofing victim IP addresses against open DNS resolvers, attackers directed large amplified replies at target servers while general UDP floods climbed to 31.31% of all network-layer attacks.
Who Is Behind the Activity
Analysts attribute the wave of short, high-count floods with high confidence to DDoS-for-hire “booter” platforms targeting software, gambling, and IT firms. Meanwhile, despite the earlier police takedowns, IoT botnet operators quickly deployed new Mirai variants such as Dysphoria and Evooo1Bot.
“Still, IoT-based botnets remain a durable high-volume threat as the ecosystem churns through new variants such as Dysphoria and Evooo1Bot,” the Cloudflare DDoS report stated. In August 2026, Mirai-linked traffic peaked at 57.23 petabytes, accounting for 46.5% of all mitigated network bytes during the quarter. The longest sustained Mirai assault ran for 49.7 hours between August 19 and August 21.
Impact and Global Target Shifts
Geographically, the United States overtook China as the most-attacked country in the Cloudflare DDoS report Q3 2026 rankings, while Indonesia claimed third place. In addition, Canada jumped 10 spots to sixth place amid bilateral trade disputes, with heavy traffic hitting retail and telecommunications providers. Similarly, Israel rose seven spots to tenth place following sustained mid-September attacks ahead of parliamentary elections and Rosh Hashanah. Across industry verticals, media and publishing remained the top target, while internet infrastructure, consumer services, and adult entertainment moved into the top 10.
How Organizations Can Stay Protected
Because 96% of network floods end in under 10 minutes, human analysts cannot respond fast enough to block traffic manually. “Autonomy is the point: our systems detect and mitigate attacks without human intervention,” Cloudflare explained. Therefore, enterprises should deploy automated, always-on DDoS mitigation services across both HTTP and network layers. Finally, hosting providers and internet service providers can join Cloudflare’s free DDoS Botnet Threat Feed, which now includes over 800 participating networks working together to shut down malicious botnet nodes.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
