Industry NewsAI Business & Ecosystem
Cloudflare Q3 2026 report finds DDoS attacks rising 208% as attackers shift tactics
Article content
DDoS attacks become smaller, faster and more frequent
Cloudflare has reported a significant shift in the global distributed denial-of-service (DDoS) threat landscape, with cybercriminals increasingly relying on smaller, shorter and more frequent attacks rather than concentrating solely on large-scale disruptions.
The company's DDoS Threat Report for Q3 2026, covering July to September, found that Cloudflare autonomously mitigated 18.2 million network-layer DDoS attacks during the quarter. This represented a 208% increase compared with the same period last year and an average of approximately 8,226 attacks every hour.
The findings point to a changing challenge for organisations responsible for protecting websites, digital platforms and critical online services. Although the number of extremely high-volume attacks declined, the growing volume of short-duration incidents demonstrates how accessible attack infrastructure is enabling threat actors to launch disruption attempts at scale.
According to Cloudflare, 96% of network-layer attacks ended in under 10 minutes, while 98% remained below 1 Gbps. The company associates this pattern with DDoS-for-hire services, commonly known as booter services, which allow attackers to launch disruptive activity without operating their own large-scale infrastructure.
Attacks exceeding 1 Tbps decline nearly 69%
One of the report's most notable findings was the sharp decline in hyper-volumetric attacks exceeding 1 terabit per second (Tbps).
Cloudflare recorded 251 attacks above this threshold in Q3, down from 805 in Q2, a reduction of nearly 69%. The decline coincided with law enforcement action earlier in 2026 that dismantled four major IoT botnets: Aisuru, KimWolf, JackSkid and Mossad.
However, the report cautions against interpreting the decline as a lasting reduction in the IoT botnet threat. New variants, including Dysphoria and Evooo1Bot, continue to emerge.
Mirai-classified activity also remained significant. Cloudflare recorded 57.23 petabytes of mitigated Mirai-related traffic in August, accounting for 46.5% of all network-layer bytes mitigated during the quarter. The longest sustained Mirai attack recorded in the period lasted 49.7 hours, running from August 19 to August 21.
The figures illustrate how disruption of major botnet infrastructure can affect attack volumes, while the emergence of new variants keeps the broader threat active.
Attackers abandon CLDAP and shift towards DNS and UDP
The report also identified a substantial change in the techniques used to amplify and direct DDoS traffic.
After increasing sharply during the first half of 2026, CLDAP (Connectionless Lightweight Directory Access Protocol) attacks fell by 99.5% quarter-over-quarter, accounting for just 0.05% of network-layer attacks in Q3.
Attackers increasingly turned to alternative methods. DNS amplification attacks rose 215%, accounting for 3.43% of network-layer incidents. Other UDP floods also gained ground, increasing their share of attacks from 14.06% in Q2 to 31.31% in Q3.
These changes highlight the adaptability of threat actors, who can shift between attack vectors as techniques become less effective or infrastructure is disrupted. For security teams, the findings reinforce the need to monitor a broad range of network-level threats rather than focusing on a single attack method.
Geopolitical tensions influence the threat landscape
Cloudflare's analysis also found changes in the geographic distribution of targeted attacks.
The United States reclaimed the position of the world's most-attacked location from China, which ranked second. Indonesia entered the top three, accounting for 2.93% of total attacks.
Canada recorded one of the largest movements, rising from 16th to sixth place amid ongoing trade disputes. Israel climbed seven positions to rank tenth, following sustained DDoS activity in mid-September ahead of parliamentary elections.
The findings indicate that geopolitical developments, trade tensions and domestic events can coincide with shifts in cyberattack activity, adding another dimension to the risk environment for organisations operating across multiple markets.
A wider range of industries faces exposure
The distribution of attacks across industries also broadened during the quarter.
Media, Production and Publishing remained the most-attacked industry, although its overall share fell to roughly a quarter of its Q2 level. Other sectors moved higher in the rankings, including Internet infrastructure, which rose to sixth place, Consumer Services at eighth and Adult Entertainment at ninth.
The shift suggests that DDoS activity is not concentrated in a narrow group of industries. Organisations across digital services, technology and consumer-facing sectors can face disruption risks as attackers broaden their targets.
What the findings mean for organisations in Australia and New Zealand
For organisations in Australia and New Zealand, the report offers a broader indication of the changing DDoS threat environment facing digitally dependent businesses.
As companies expand their online services, cloud infrastructure and customer-facing platforms, maintaining availability becomes an increasingly important part of operational resilience. The rise in short-duration attacks is particularly relevant because incidents lasting only a few minutes can still disrupt access to websites, applications and online services.
The findings also underline the importance of automated detection and mitigation. With most network-layer attacks ending in under 10 minutes, relying solely on manual investigation and response may not be sufficient to address high-frequency attack activity.
Cloudflare's Q3 findings ultimately point to a threat landscape defined not only by the size of individual attacks, but also by their frequency, speed and changing methods. Even as the largest attacks become less common, the growing volume of smaller incidents presents a persistent challenge for organisations seeking to keep their digital operations available and resilient.
About Cloudflare
Cloudflare is a global connectivity cloud company that provides services designed to help organisations make their applications, networks and digital infrastructure more secure, reliable and performant. Its network spans more than 330 cities globally and supports security, performance and connectivity services.