Threat actors ramped up automated disruption in the third quarter of 2026, with Cloudflare reporting a dramatic rise in the frequency and variety of distributed denial-of-service (DDoS) attacks. The company mitigated 18.2 million network-layer (L3) DDoS attacks and handled 14.4 trillion HTTP DDoS requests during the quarter — a scale that underscores how persistent and rapidly evolving DDoS activity has become.
Quarterly volume and pace
Cloudflare’s numbers translate to roughly 8,226 network-layer attacks per hour, about 197,400 attacks per day, or an attack occurring every 0.44 seconds. That represents a significant jump from earlier quarters: 13.2 million L3 attacks in Q2 and 10.0 million in Q1 of 2026. Cloudflare attributes much of the rise to the continued availability and use of DDoS-for-hire booter and stresser services, which are responsible for hundreds of thousands of individual attacks.
Shifts in attack character
While overall attack counts climbed, the nature of many attacks shifted. Short-burst, low-bandwidth attacks — those under 10 minutes and below 1 Gbps — surged by 208%, reflecting a move toward brief, high-frequency disruption attempts. Conversely, hyper-volumetric attacks above 1 Tbps fell sharply, declining 69% quarter-over-quarter from 805 incidents in Q2 to 251 in Q3. Cloudflare linked that decline in part to law enforcement actions taken earlier in the year against groups such as AISURU, KimWolf, JackSkid, and Mossad.
Emerging tactics and protocols
Several changes in attack vectors were noted. DNS amplification attacks increased by 215% and accounted for 3.43% of all network-layer incidents in the quarter. At the same time, Connectionless Lightweight Directory Access Protocol (CLDAP) floods showed a decline. Cloudflare also warned of new variants and tools — including Dysphoria and Evooo1Bot — that continue to evolve the threat landscape despite reductions in some high-volume campaigns.
Who’s being targeted
The industries most frequently hit by these network-layer attacks included media, production and publishing; information technology and services; gambling and casinos; computer software; and telecommunications providers. Geographically, the United States, China, Indonesia, the United Kingdom, and Türkiye were the most targeted countries in Q3. Notably, Canada and Israel entered the top 10, with increased attacks aimed at Canada’s retail, telecommunications, and marketing sectors.
What the numbers imply
The report paints a picture of a DDoS landscape that is both larger in volume and more varied in tactics. Short-duration attacks and amplification methods are rising, while ultra-high-capacity attacks have dropped — likely the combined result of law enforcement disruption and shifting adversary strategies. The persistence of booter services and the appearance of new attack variants indicate that the overall threat remains active and adaptive.
Licensed under CC BY-ND 4.0 International