Cloudflare Q3 2026 Report: DDoS Attacks Shift to High-Frequency Swarms as Giant Botnets Fall — Internet, networks and telecom

In the third quarter of 2026, Cloudflare mitigated over 8,200 DDoS attacks per hour as threat actors pivoted toward short-burst, low-bandwidth strikes. While hyper-volumetric attacks dropped significantly following major botnet takedowns, DNS amplification and UDP floods surged, with the United States reclaiming the top spot for targeted locations.

Cloudflare has released its 26th DDoS Threat Report, covering the third quarter of 2026, which reveals a distinct shift in attack patterns characterized by more frequent, smaller strikes rather than massive volumetric events. During July, August, and September, the company autonomously mitigated 18.2 million network-layer DDoS attacks and 14.4 trillion HTTP requests. This volume translates to approximately 8,226 network-layer attacks per hour, or one attack every 0.44 seconds, with total mitigated traffic reaching 272.6 petabytes at the network layer.

The data indicates a dramatic rise in short-burst, low-bandwidth attacks lasting under 10 minutes and staying below 1 Gbps, which surged by 208% compared to the same period in 2025. These rapid strikes, often associated with DDoS-for-hire services, primarily targeted computer software, gambling, and information technology sectors. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from the previous quarter, dropping from 805 incidents in Q2 to just 251 in Q3. This decline coincides with law enforcement actions earlier in 2026 that dismantled four major IoT botnets: Aisuru, KimWolf, JackSkid, and Mossad.

Despite the reduction in giant botnets, IoT-based threats remain durable as new variants like Dysphoria and Evooo1Bot emerge. Mirai-classified attacks peaked in August, accounting for 46.5% of all mitigated network-layer bytes that quarter. The longest sustained Mirai attack recorded during this period lasted nearly 50 hours between August 19 and August 21.

Attack vectors also underwent significant transformation. CLDAP floods, which had surged earlier in the year, collapsed by 99.5% quarter-over-quarter, accounting for only 0.05% of attacks in Q3. Threat actors instead pivoted to other connectionless protocols, driving a 215% increase in DNS amplification and a 122% rise in general UDP floods. These methods exploit open resolvers and the nature of the UDP protocol to consume target resources without establishing connections.

Geographically and industrially, the landscape broadened significantly. The United States reclaimed the position of the most-attacked location from China, which fell to second place, while Indonesia rose into the top three. Canada and Israel experienced sharp increases in targeted attacks, jumping 10 and 7 spots respectively. These surges in Canada were linked to attacks on retail and telecommunications sectors amidst trade disputes, while Israel's spike occurred during a period of geopolitical tension and domestic events ahead of parliamentary elections.

In terms of industry targets, Media, Production & Publishing remained the most attacked sector but saw its share drop to roughly a quarter of its Q2 level. The focus shifted toward a wider array of industries, with Internet infrastructure rising to sixth place, while Consumer Services and Adult Entertainment entered the top ten. Cloudflare noted that its global network, spanning over 330 cities with 500 Tbps of capacity, is designed to handle this autonomous mitigation, as most attacks conclude before human analysts could intervene.

Sources: Cloudflare Blog.