Loading story…
A major user-generated content platform was hit by a highly distributed low-and-slow DDoS campaign that generated 2.45 billion malicious requests in five hours, peaking at 205,344 requests per second and averaging about 136,000 requests per second. According to DataDome’s Galileo threat research team, the operation relied on more than 1.2 million unique IP addresses spread across 16,402 ASNs, with no single network contributing more than 3% of the traffic. The attackers used a pulsed cadence and kept per-IP activity low—roughly one request every nine seconds on average—to stay below conventional rate-limiting thresholds and make simple IP blocking ineffective.
The traffic was designed to resemble legitimate users by rotating IPs, user agents, and payloads and by forging HTTP headers, cookies, and TLS fingerprints. Researchers said the botnet also blended traffic through anonymization-friendly providers and major cloud infrastructure including Cloudflare, AWS, and Google, complicating filtering efforts. DataDome reported that it detected and blocked the attack in real time using behavioral analysis, server-side fingerprinting, and threat intelligence, finding inconsistencies between claimed browser identities and actual TLS handshake behavior. The incident underscores how modern DDoS operators are shifting from brute-force floods to distributed evasion techniques that require time-based behavioral detection rather than static volume limits.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
By early May 2026, DataDome publicly disclosed technical details of the incident and concluded that defenders should prioritize time-based behavioral detection over static rate limits for similarly fragmented DDoS attacks. The report highlighted the growing use of highly distributed, low-and-slow evasion techniques.
DataDome's Galileo threat research team identified the attack in real time and blocked it using behavioral analysis, server-side fingerprinting, and threat intelligence rather than static volume thresholds. Researchers said inconsistencies in TLS handshakes and browser-identification signals exposed the bots despite their attempts to blend in.
During the campaign, the botnet spread traffic across more than 1.2 million unique IP addresses and 16,402 ASNs, with no single network contributing more than 3% of the volume. Operators also rotated IPs, user agents, payloads, forged HTTP headers, cookies, and TLS fingerprints to imitate legitimate browsers and frustrate simple blocking.
In mid-April 2026, a highly distributed DDoS campaign targeted a major user-generated content platform, sending 2.45 billion malicious requests over roughly five hours. The attack peaked at 205,344 requests per second and used a low-and-slow pattern to stay below typical per-IP rate-limiting thresholds.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A March multinational operation involving the United States, Canada, and Germany disrupted infrastructure supporting the Aisiru and Kimwolf botnets, contributing to a fall in the largest observed botnet from 13.5 million devices in Q1 2026 to 2.09 million in Q2. Link11 also reported a 42% decline in DDoS attacks in Europe during the first half of 2026, partly attributing the reduction to law-enforcement actions including Operation Eastwood and the shutdown of four IoT botnets. Attackers are compensating with more powerful and resilient campaigns: Link11 recorded peaks of **2.3 Tbit/s** and **322 million packets per second**, with 705 TB of cumulative malicious traffic, driven by super-botnets and hijacked cloud servers. Operators are increasingly dispersing traffic sources and adopting decentralized command infrastructure; the Aeternum and Void botnets use Polygon and Ethereum smart contracts for C2 distribution. DDoS surges are also being used to conceal SQL-injection and XSS probing, requiring defenses that combine continuous traffic inspection, behavioral detection, adaptive filtering, and application-layer monitoring.
Sep 4, 2026
Cloudflare said it mitigated **23.2 million network-layer DDoS attacks** and **29.64 trillion** malicious HTTP requests in the first half of 2026, with April marking the peak of activity. The sharpest growth came from hyper-volumetric attacks: **935 network-layer attacks exceeded 1 Tbps** in H1, including **805 in Q2**, up from about 130 in Q1. The company said attackers increasingly shifted from traditional botnet floods to **reflection and amplification** methods, with **DNS-based attacks** becoming the leading network-layer vector and **CLDAP floods** rising 580 percent quarter over quarter to become the third most common vector in Q2. Cloudflare linked the wave to geopolitical flashpoints and major events, saying **media, production, and publishing** became the most targeted sector as attackers sought to disrupt reporting and suppress information around the wars involving Ukraine and Iran and the FIFA World Cup. Government entities also saw increased targeting following the US-Israeli operation against Iran, while the US, China, and Turkey ranked among the most-targeted regions, including elevated attacks around the Ankara NATO Summit. Cloudflare said DDoS activity declined after April and suggested the drop may be tied to **Operation PowerOFF**, a multinational law-enforcement crackdown on DDoS-for-hire services.
Aug 18, 2026
Cloudflare reported mitigating a **record-setting hyper-volumetric DDoS attack** attributed to the **AISURU/Kimwolf** botnet that peaked at **31.4 Tbps** and lasted **35 seconds** in **November 2025**. The activity was described as part of a broader late-2025 surge in hyper-volumetric HTTP DDoS events that Cloudflare said were automatically detected and blocked, with **Q4 2025** hyper-volumetric attacks increasing **40%** quarter-over-quarter and the largest attacks growing **700%** compared to late 2024. Reporting tied AISURU/Kimwolf to DDoS-for-hire style operations and additional campaigns such as **“The Night Before Christmas”** (starting **December 19, 2025**), with Cloudflare citing campaign averages around **3 Bpps**, **4 Tbps**, and **54 Mrps**, and peaks up to **9 Bpps**, **24 Tbps**, and **205 Mrps**. The botnet’s capabilities and impact extend beyond web-layer floods: it has been associated with UDP/TCP/GRE flooding techniques and disruption of broadband providers via traffic sourced from compromised customer devices/CPE, and it has been described as enabling other illicit activity (e.g., credential stuffing, scraping, spam, phishing); separate reporting also stated the botnet has leveraged a large pool of compromised devices, including **millions of Android-based endpoints** such as off-brand Android TVs.
Jun 29, 2026