Cloudflare reports sixfold surge in 1 Tbps DDoS attacks

Cloudflare mitigated 805 network-layer DDoS attacks exceeding 1 terabit per second in the second quarter of 2026, a more than sixfold increase from the 130 recorded in the first quarter, the company reported Tuesday in its 25th DDoS Threat Report. The 519% quarter-over-quarter surge brought the half-year total to 935 attacks above the 1 Tbps threshold, compared with 219 in the fourth quarter of 2025.

The report, presented at the Black Hat security conference, covers January through June 2026 — the first time Cloudflare has combined two quarters into a single volume. Over the period, the company mitigated 23.2 million network-layer DDoS attacks and absorbed 29.64 trillion malicious HTTP requests, a pace of roughly 5,343 network-layer attacks per hour.

DNS Floods and New Amplification Vectors

The center of gravity shifted from botnet floods toward reflection and amplification techniques. DNS-based attacks accounted for 34.3% of all network-layer activity in the first half, with DNS Flood alone climbing from 25.7% to 40% of network-layer attacks between quarters. CLDAP Flood — which abuses exposed Active Directory domain controllers on UDP port 389 — surged to become the third most common vector in Q2. Older vectors faded: SSDP Flood dropped 87% and SNMP Flood fell 89%.

Despite the growth in extreme attacks, most incidents remained small and brief. Some 96.62% of network-layer attacks stayed under 500 Mbps and 90.6% ended within 10 minutes. Cloudflare noted that even brief bursts can trigger cascading failures — routing instability, TCP retransmissions, and service degradation lasting hours or days.

Geopolitics Shape the Target Map

Geopolitical events drove targeting patterns. After the United States and Israel launched Operation Epic Fury against Iranian leadership on February 28, security researchers logged 149 hacktivist DDoS claims against 110 organizations in 16 countries within 72 hours. The government sector jumped from 29th to 9th in Cloudflare's rankings by share of mitigated HTTP requests — the largest single-sector movement of 2026.

Media, Production and Publishing held the most-attacked industry position in both quarters at 14.2% of mitigated HTTP traffic, nearly four times the runner-up. Turkey climbed to the third most-attacked country as tensions built around the NATO summit in Ankara, while Brazil overtook the United States as the top source of attack traffic at 14.9% versus 13.4%.

April Peak and Law Enforcement Impact

April marked the high point, with 6.46 trillion HTTP DDoS requests and 165 petabytes of attack traffic. Activity declined afterward, a shift Cloudflare tentatively attributed to Operation PowerOFF, a 21-country crackdown that targeted more than 75,000 DDoS-for-hire users, took down 53 domains, and resulted in four arrests.

Cloudflare offers hosting providers and ISPs a free botnet threat feed to help identify abusive IP addresses, with more than 800 networks now enrolled.