Cloudflare Reports 38% Surge in Q3 Network-Layer DDoS Attacks
Network-layer attacks reached 18.2 million in Q3, averaging one strike every 0.44 seconds.
1Escalating Attack Frequency
Cloudflare recorded 18.2 million network-layer DDoS attacks during the third quarter of 2026. This represents a significant 38% increase compared to the previous quarter. Threat actors are currently launching approximately 8,226 attacks per hour, which translates to a constant barrage of one attack every 0.44 seconds globally.
2Shift in Attack Tactics
While total volume increased, the nature of these threats is evolving rapidly. Short-burst, low-bandwidth attacks lasting under 10 minutes and remaining under 1 Gbps surged by 208%. Meanwhile, DNS amplification attacks jumped by 215%, now accounting for 3.43% of all network-layer incidents observed across the global infrastructure.
3Decline of Volumetric Threats
Hyper-volumetric attacks exceeding 1 Tbps saw a 69% decline compared to the second quarter. The number of such massive attacks dropped from 805 to 251. This reduction is attributed to coordinated law enforcement actions taken in March against specific groups like AISURU, KimWolf, JackSkid, and Mossad.
4Drivers of Increased Activity
The surge in overall attack frequency is linked to the proliferation of DDoS-for-hire booter or stresser services. These platforms enable threat actors to execute hundreds of thousands of attacks with minimal technical expertise. Despite law enforcement efforts, the emergence of new botnet variants like Dysphoria and Evooo1Bot sustains the threat.
5Most Targeted Industry Sectors
The third quarter saw specific industries facing the brunt of these malicious campaigns. Media, production, and publishing sectors were primary targets, alongside information technology and services. Additionally, gambling, casinos, computer software companies, and telecommunications providers experienced high levels of disruption, reflecting the broad reach of modern DDoS-for-hire service capabilities.
6Geographic Distribution of Attacks
The United States, China, Indonesia, the United Kingdom, and Türkiye emerged as the most targeted countries during this period. Canada and Israel also entered the top ten ranking. In Canada, the attacks were specifically fueled by malicious activity directed toward the retail, telecommunications, and marketing sectors throughout the quarter.
7HTTP Request Volume Metrics
Beyond network-layer threats, Cloudflare autonomously mitigated 14.4 trillion HTTP DDoS requests during the third quarter. This volume underscores the massive scale of application-layer targeting occurring alongside network-layer floods. The company continues to rely on automated mitigation systems to handle these 197,400 daily attacks without manual intervention from security teams.
8Strategic Security Implications
The data confirms that while high-volume volumetric attacks are decreasing due to legal pressure, the frequency of smaller, persistent attacks is rising. Organizations must prioritize visibility into identity gaps and AI threat readiness. Strengthening attack surface management remains critical as new botnet variants continue to challenge existing network security infrastructure.
Original article: The Hacker News — Cloudflare Reports 38% Surge in Q3 Network-Layer DDoS Attacks