Loading story…
Cloudflare successfully mitigated the largest distributed denial-of-service (DDoS) attack ever recorded, which peaked at 22.2 terabits per second and 10.6 billion packets per second. The attack, which lasted approximately 40 seconds, was automatically detected and blocked by Cloudflare’s network without service disruption. This incident was twice the size of any previous DDoS attack seen on the internet, highlighting the increasing scale and frequency of such attacks. Cloudflare did not disclose the specific target of the attack but emphasized the importance of robust, automated DDoS mitigation capabilities for organizations. The event underscores the ongoing escalation in DDoS attack volumes and the need for advanced protection measures.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Cloudflare reported blocking what it described as the largest distributed denial-of-service attack it had seen, peaking at 22.2 Tbps. The event was disclosed publicly in coverage published on September 24, 2025.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare successfully detected and mitigated the largest distributed denial-of-service (DDoS) attack on record, which peaked at 29.7 terabits per second and was attributed to the AISURU botnet. The attack, which lasted 69 seconds, utilized UDP carpet-bombing techniques targeting an average of 15,000 destination ports per second, and originated from a botnet-for-hire service leveraging between one and four million compromised routers and IoT devices worldwide. While the specific target of the attack was not disclosed, Cloudflare noted that the AISURU botnet has been responsible for a surge in hyper-volumetric DDoS attacks, particularly against telecommunications, gaming, hosting, and financial services sectors. AISURU's operations have resulted in over 2,800 attacks mitigated by Cloudflare since the start of the year, with nearly half classified as hyper-volumetric, exceeding 1 Tbps or 1 billion packets per second. The botnet's activity has not only set new records for DDoS attack volume but has also demonstrated the potential to disrupt internet service providers even when they are not the direct targets. The majority of attack sources have been traced to locations in Asia, and the overall frequency and scale of DDoS attacks have seen significant increases compared to previous quarters and years.
Jun 29, 2026
Cloudflare said it mitigated **23.2 million network-layer DDoS attacks** and **29.64 trillion** malicious HTTP requests in the first half of 2026, with April marking the peak of activity. The sharpest growth came from hyper-volumetric attacks: **935 network-layer attacks exceeded 1 Tbps** in H1, including **805 in Q2**, up from about 130 in Q1. The company said attackers increasingly shifted from traditional botnet floods to **reflection and amplification** methods, with **DNS-based attacks** becoming the leading network-layer vector and **CLDAP floods** rising 580 percent quarter over quarter to become the third most common vector in Q2. Cloudflare linked the wave to geopolitical flashpoints and major events, saying **media, production, and publishing** became the most targeted sector as attackers sought to disrupt reporting and suppress information around the wars involving Ukraine and Iran and the FIFA World Cup. Government entities also saw increased targeting following the US-Israeli operation against Iran, while the US, China, and Turkey ranked among the most-targeted regions, including elevated attacks around the Ankara NATO Summit. Cloudflare said DDoS activity declined after April and suggested the drop may be tied to **Operation PowerOFF**, a multinational law-enforcement crackdown on DDoS-for-hire services.
Aug 18, 2026
Cloudflare reported mitigating a record-breaking **hyper-volumetric DDoS campaign** attributed to the **Aisuru/Kimwolf botnet**, with a peak of **31.4 Tbps** and application-layer floods exceeding **200 million HTTP requests per second**. Cloudflare said the activity—named **“The Night Before Christmas”** due to its timing—began on **December 19, 2025** and targeted both **Cloudflare customers** and **Cloudflare’s own dashboard/infrastructure**, with many victims described as telecommunications providers and IT organizations. Reporting on Cloudflare’s findings indicates the campaign consisted of **thousands of individual attacks** that were typically short in duration (often **1–2 minutes**), with the majority peaking in the **1–5 Tbps** range and **1–5 billion packets per second**. The botnet was also linked to prior record-setting activity (including a previously disclosed **29.7 Tbps** peak), and Cloudflare attributed the attack sources in this campaign primarily to **compromised Android TV/streaming devices**; Cloudflare stated the attacks were **automatically detected and mitigated** without triggering internal alerts.
Jun 29, 2026