Cloudflare finds the largest DDoS attacks fell 69% as total attacks rose 208%

A new report out today from Cloudflare Inc.’s Cloudforce One threat intelligence unit finds that the largest distributed denial-of-service attacks fell nearly 69% in the third quarter, and network-layer attacks overall more than tripled from a year earlier, to 18.2 million.

The “Cloudflare DDoS Threat Report 2026 Q3” details 251 attacks above 1 terabit per second between July and September. The second quarter produced 805, after a sixfold rise from the first three months of the year. Cloudflare ties the drop, tentatively, to law enforcement action earlier this year against four of the largest botnets built from compromised internet of things devices.

The Justice Department announced the disruption of Aisuru, Kimwolf, JackSkid and Mossad in March, when authorities in Canada and Germany also moved against people allegedly behind them. Internet of things botnets remain a durable, high-volume threat in Cloudflare’s assessment, with new variants such as Dysphoria and Evooo1Bot already circulating.

August was the heaviest month for Mirai-classified traffic, at 57.23 petabytes. The quarter’s longest Mirai attack began Aug. 19 and kept going for 49.7 hours.

Small attacks made up most of the quarter’s 18.2 million, which work out to about 8,226 an hour. Nearly all were over quickly, 96% of them inside 10 minutes, and bandwidth stayed under 1 gigabit per second in 98% of cases.

The report points out that a flood that size is still more than enough to overwhelm a server or website. Cloudflare reads the overall profile as the signature of DDoS-for-hire “booter” services.

Attackers also switched methods. Floods abusing the Connectionless Lightweight Directory Access Protocol grew 580% in the first half of the year, according to the report. In the third quarter CLDAP made up just 0.05% of attacks, down 99.5% on the second quarter.

Other connectionless protocols filled the gap. Amplification attacks using the Domain Name System rose 215% from the second quarter to 3.4% of the network-layer total. The bigger beneficiary was the generic User Datagram Protocol flood, which went from 14.1% of attacks to 31.3%. Plain DNS floods held steady as the most common method, at 39.3%.

Media, production and publishing kept the top spot among industries with only about a fourth of the share it held from April to June, as attackers spread their aim more widely. The internet sector climbed to sixth from 12th. Further down the table, consumer services rose nine places to eighth and adult entertainment entered the top 10 in ninth after ranking 21st three months earlier.

Geographically, the U.S. was the most-attacked country in the third quarter after finishing second to China in the first half. Indonesia rose to third with 2.93% of attacks.

Canada and Israel made the sharpest climbs. Canada went from 16th to sixth on attacks against retail, telecommunications and marketing companies, during what the report called “an already turbulent period of bilateral trade disputes.” Israel moved up seven places to 10th on sustained DDoS activity in mid-September. That stretch brought contentious decisions ahead of parliamentary elections as well as the Rosh Hashanah holiday, the report noted, against a wider surge in hostile cyber warfare targeting Israel this year.

Cloudflare’s systems detect and mitigate attacks without human intervention. The report says they have to, since most attacks in the quarter “end long before a human analyst could see the alert.”

A message from John Furrier, co-founder of SiliconANGLE:

Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.

Are you an AWS customer? Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: https://siliconangle.com/aws-marketplace/

Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.

Source: SiliconANGLE