Cloudflare Reports Surge in 1 Tbps DDoS Attacks Driven by DNS Floods and Geopolitical Events

Cloudflare said it mitigated 23.2 million network-layer DDoS attacks and 29.64 trillion malicious HTTP requests in the first half of 2026, with April marking the peak of activity. The sharpest growth came from hyper-volumetric attacks: 935 network-layer attacks exceeded 1 Tbps in H1, including 805 in Q2, up from about 130 in Q1. The company said attackers increasingly shifted from traditional botnet floods to reflection and amplification methods, with DNS-based attacks becoming the leading network-layer vector and CLDAP floods rising 580 percent quarter over quarter to become the third most common vector in Q2.

Cloudflare linked the wave to geopolitical flashpoints and major events, saying media, production, and publishing became the most targeted sector as attackers sought to disrupt reporting and suppress information around the wars involving Ukraine and Iran and the FIFA World Cup. Government entities also saw increased targeting following the US-Israeli operation against Iran, while the US, China, and Turkey ranked among the most-targeted regions, including elevated attacks around the Ankara NATO Summit. Cloudflare said DDoS activity declined after April and suggested the drop may be tied to Operation PowerOFF, a multinational law-enforcement crackdown on DDoS-for-hire services.