Loading story…
Cloudflare said it mitigated 23.2 million network-layer DDoS attacks and 29.64 trillion malicious HTTP requests in the first half of 2026, with April marking the peak of activity. The sharpest growth came from hyper-volumetric attacks: 935 network-layer attacks exceeded 1 Tbps in H1, including 805 in Q2, up from about 130 in Q1. The company said attackers increasingly shifted from traditional botnet floods to reflection and amplification methods, with DNS-based attacks becoming the leading network-layer vector and CLDAP floods rising 580 percent quarter over quarter to become the third most common vector in Q2.
Cloudflare linked the wave to geopolitical flashpoints and major events, saying media, production, and publishing became the most targeted sector as attackers sought to disrupt reporting and suppress information around the wars involving Ukraine and Iran and the FIFA World Cup. Government entities also saw increased targeting following the US-Israeli operation against Iran, while the US, China, and Turkey ranked among the most-targeted regions, including elevated attacks around the Ankara NATO Summit. Cloudflare said DDoS activity declined after April and suggested the drop may be tied to Operation PowerOFF, a multinational law-enforcement crackdown on DDoS-for-hire services.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
On August 13, 2026, Cloudflare's Cloudforce One published the 25th edition of its DDoS Threat Report covering January through June 2026. The report summarized 23.2 million network-layer attacks, 29.64 trillion HTTP DDoS requests, and a sharp rise in hypervolumetric attacks above 1 Tbit/s.
Cloudflare published its H1 2026 DDoS Threat Report, stating it mitigated 23.2 million network-layer attacks and 29.64 trillion HTTP DDoS requests during the first half of the year. The report highlighted DNS floods as the dominant vector and media organizations as the most-targeted sector.
Cloudflare reported that Turkey rose to the third most-targeted country or region in Q2 after more than doubling its share of global attack traffic. The increase was linked to the Ankara NATO summit held in July.
Cloudflare observed the highest DDoS activity in April 2026, including 6.46 trillion HTTP DDoS requests and 165 petabytes of network-layer attack traffic. The company said activity declined after this peak.
On February 28, 2026, Israel and the United States launched Operation Epic Fury targeting Iran’s leadership and infrastructure. Cloudflare later linked subsequent hacktivist DDoS activity and increased attacks on government entities to this geopolitical event.
Within 72 hours of Operation Epic Fury, security researchers recorded 149 hacktivist DDoS claims against 110 organizations across 16 countries. Nearly 47.8% of the claimed targets were in the government sector.
In December 2025, Cloudflare mitigated a 31.4 Tbps DDoS attack, which the article attributes to the Aisuru/Kimwolf botnet. The incident illustrated how compromised devices such as routers, cameras, servers, appliances, and smart TVs can be assembled into massive botnets.
Cloudflare mitigated 805 network-layer DDoS attacks exceeding 1 Tbps in Q2 2026, a 519% increase over Q1. The quarter also saw a shift toward DNS-related reflection and amplification techniques.
Cloudflare said DDoS activity dropped after April 2026 partly because of Operation PowerOFF, a 21-country law-enforcement effort against DDoS-for-hire networks. The operation seized 53 domains, executed 25 search warrants, arrested four suspects, and targeted more than 75,000 users to date.
Cloudflare recorded 130 network-layer DDoS attacks exceeding 1 Tbps during Q1 2026. This served as the baseline before a much larger surge in the following quarter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberveille.ch
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourceblog.cloudflare.com
Open sourcebleepingcomputer.com
Open sourcesdxcentral.com
Open sourceblog.cloudflare.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A major user-generated content platform was hit by a highly distributed **low-and-slow DDoS campaign** that generated **2.45 billion malicious requests in five hours**, peaking at **205,344 requests per second** and averaging about **136,000 requests per second**. According to DataDome’s Galileo threat research team, the operation relied on more than **1.2 million unique IP addresses** spread across **16,402 ASNs**, with no single network contributing more than 3% of the traffic. The attackers used a pulsed cadence and kept per-IP activity low—roughly one request every nine seconds on average—to stay below conventional rate-limiting thresholds and make simple IP blocking ineffective. The traffic was designed to resemble legitimate users by rotating IPs, user agents, and payloads and by forging HTTP headers, cookies, and TLS fingerprints. Researchers said the botnet also blended traffic through anonymization-friendly providers and major cloud infrastructure including **Cloudflare, AWS, and Google**, complicating filtering efforts. DataDome reported that it detected and blocked the attack in real time using **behavioral analysis**, server-side fingerprinting, and threat intelligence, finding inconsistencies between claimed browser identities and actual TLS handshake behavior. The incident underscores how modern DDoS operators are shifting from brute-force floods to distributed evasion techniques that require time-based behavioral detection rather than static volume limits.
Jun 29, 2026
Cloudflare successfully detected and mitigated the largest distributed denial-of-service (DDoS) attack on record, which peaked at 29.7 terabits per second and was attributed to the AISURU botnet. The attack, which lasted 69 seconds, utilized UDP carpet-bombing techniques targeting an average of 15,000 destination ports per second, and originated from a botnet-for-hire service leveraging between one and four million compromised routers and IoT devices worldwide. While the specific target of the attack was not disclosed, Cloudflare noted that the AISURU botnet has been responsible for a surge in hyper-volumetric DDoS attacks, particularly against telecommunications, gaming, hosting, and financial services sectors. AISURU's operations have resulted in over 2,800 attacks mitigated by Cloudflare since the start of the year, with nearly half classified as hyper-volumetric, exceeding 1 Tbps or 1 billion packets per second. The botnet's activity has not only set new records for DDoS attack volume but has also demonstrated the potential to disrupt internet service providers even when they are not the direct targets. The majority of attack sources have been traced to locations in Asia, and the overall frequency and scale of DDoS attacks have seen significant increases compared to previous quarters and years.
Jun 29, 2026
A March multinational operation involving the United States, Canada, and Germany disrupted infrastructure supporting the Aisiru and Kimwolf botnets, contributing to a fall in the largest observed botnet from 13.5 million devices in Q1 2026 to 2.09 million in Q2. Link11 also reported a 42% decline in DDoS attacks in Europe during the first half of 2026, partly attributing the reduction to law-enforcement actions including Operation Eastwood and the shutdown of four IoT botnets. Attackers are compensating with more powerful and resilient campaigns: Link11 recorded peaks of **2.3 Tbit/s** and **322 million packets per second**, with 705 TB of cumulative malicious traffic, driven by super-botnets and hijacked cloud servers. Operators are increasingly dispersing traffic sources and adopting decentralized command infrastructure; the Aeternum and Void botnets use Polygon and Ethereum smart contracts for C2 distribution. DDoS surges are also being used to conceal SQL-injection and XSS probing, requiring defenses that combine continuous traffic inspection, behavioral detection, adaptive filtering, and application-layer monitoring.
Sep 4, 2026