Cloudflare DDoS Threat Report: Shift Toward Short-Burst Swarm Attacks
Hyper-volumetric attacks decline as short-burst, high-frequency botnet activity surges globally.
1Q3 2026 Threat Landscape
Cloudflare mitigated 18.2 million network-layer DDoS attacks during the third quarter of 2026. This equates to approximately 8,226 attacks per hour, or one incident every 0.44 seconds. Total mitigated traffic reached 272.6 petabytes at the network layer, alongside 95.1 petabytes of HTTP DDoS requests, highlighting the immense scale of modern automated threats.
2Rise of Swarm Attacks
Short-burst, low-bandwidth attacks lasting under 10 minutes surged by 208% compared to the previous year. These high-frequency, mid-range attacks, often associated with booter-for-hire services, now dominate the threat landscape. Approximately 96% of these network-layer attacks concluded in under 10 minutes, effectively overwhelming servers while remaining below the 1 Gbps threshold.
3Decline of Hyper-Volumetric Threats
Hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from the second quarter of 2026. This sharp decline follows coordinated law enforcement actions that dismantled four major IoT botnets: Aisuru, KimWolf, JackSkid, and Mossad. Despite this success, new botnet variants like Dysphoria and Evooo1Bot continue to emerge within the ecosystem.
4Vector Shift in Amplification
Attackers abandoned CLDAP reflection tactics, which collapsed by 99.5% quarter-over-quarter. Instead, threat actors pivoted toward DNS amplification, which surged by 215%, and general UDP floods, which climbed to 31.31% of all network-layer attacks. These connectionless protocols allow attackers to spoof queries and force targets to consume significant network and compute resources.
5Geographic Attack Distribution
The United States reclaimed the top position as the most-attacked location, followed by China and Indonesia. Canada and Israel experienced significant spikes in targeted activity, jumping 10 and 7 spots respectively. These surges correlate with ongoing geopolitical tensions, trade disputes, and domestic events, reflecting how regional instability influences the global cyber warfare landscape.
6Industry Target Diversification
While media organizations were previously the primary focus, the operational target list broadened significantly in Q3. Internet infrastructure, consumer services, and adult entertainment sectors saw increased activity. The computer software, gambling, and information technology industries were specifically targeted by the high-count, short-burst swarm attacks characteristic of current booter-for-hire service operational signatures.
7Mirai Botnet Persistence
Mirai-classified mitigation peaked in August 2026, accounting for 46.5% of all mitigated network-layer bytes. During that month, four separate days each saw over three petabytes of traffic cleared. The longest sustained Mirai attack recorded during the quarter lasted 49.7 hours, demonstrating the continued durability of these legacy botnet architectures.
8Autonomous Defense Strategy
Cloudflare utilizes its 500 Tbps global network capacity to mitigate attacks without human intervention. Because most modern attacks conclude in under 10 minutes, automated systems are essential for protection. Additionally, the company provides a free DDoS Botnet Threat Feed, which has been adopted by over 800 networks to facilitate collaborative takedowns.