Hackers Launch Over 18 Million DDoS Attacks in Three Months, Cloudflare Reports

In the third quarter of 2026, Cloudflare successfully mitigated 18.2 million network-layer distributed denial-of-service (DDoS) attacks. This increase indicates a trend among attackers who now favor short, frequent disruptions over large traffic floods. Compared to the same quarter in 2025, this represents a significant 208% rise in the frequency of attacks across Cloudflare’s network.

Published October 29, the Cloudflare Q3 2026 DDoS Threat Report covers July through September. Cloudforce One, the company’s threat intelligence organization, recorded about 8,226 network-layer attacks per hour, along with 14.4 trillion malicious HTTP requests. These measurements represent separate categories, rather than a combined count of individual attacks.

Mitigated traffic reached 272.6 petabytes at the network layer and 95.1 petabytes at the HTTP layer, underscoring the sustained infrastructure burden behind the quarterly totals.

Hackers Launch Over 18 Million DDoS Attacks

The defining trend was frequency: 96% of network-layer attacks ended within ten minutes, while 98% remained below 1 Gbps. Although comparatively small, these floods can still overwhelm exposed servers and websites without sufficient protection.

Cloudflare described the pattern as consistent with DDoS-for-hire “booter” services. Computer software companies, gambling and casino businesses, and information technology organizations were prominent targets of these high-count campaigns.

Meanwhile, attacks exceeding 1 Tbps fell from 805 in Q2 to 251 in Q3, a nearly 69% decline. Cloudflare noted that this reduction coincided with law enforcement disruption of Aisuru, KimWolf, JackSkid, and Mossad earlier in 2026, without establishing a definitive causal relationship.

The broader evolution of Mirai botnets into DDoS and proxy platforms shows why disrupting individual operations doesn’t eliminate the underlying ecosystem. Cloudflare continued observing emerging variants, including Dysphoria and Evooo1Bot.

Related analysis of Evooo1Bot’s router-compromising capabilities documented a combination of Mirai-derived flooding, proxy relaying, credential theft, and exploit-driven propagation.

Connectionless Lightweight Directory Access Protocol, or CLDAP, attacks collapsed 99.5% quarter over quarter, accounting for just 0.05% of network-layer attacks. This vector abuses exposed domain controllers over UDP port 389, reflecting amplified responses toward victims through spoofed source addresses.

DNS amplification moved in the opposite direction, increasing 215% and reaching 3.43% of attacks. Attackers exploit open DNS resolvers by submitting small queries that trigger larger responses directed at the victim. Other UDP floods rose from 14.06% to 31.31% of network-layer attacks, showing a broader shift toward abusing connectionless traffic.

The United States ranked as the most-attacked location, followed by China and Indonesia. Canada climbed ten positions to sixth, while Israel rose seven places to tenth. Media, Production & Publishing remained the most-attacked industry, although its share fell substantially as targeting diversified.

For defenders, the operational challenge is response speed. With most attacks ending within minutes, Cloudflare emphasized autonomous detection and mitigation rather than waiting for manual intervention. Its free botnet threat feed now serves more than 800 networks worldwide.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.