Cloudflare, a leading web infrastructure and security firm, disclosed a significant increase in network-layer distributed denial-of-service (DDoS) attacks in the third quarter of 2026. Revealed on Thursday, the report indicates that threat actors are executing approximately 8,226 such attacks per hour, marking a notable rise in cyber threats.
Escalation in DDoS Attacks
Throughout Q3 2026, Cloudflare autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and processed 14.4 trillion HTTP DDoS requests. This equates to about 197,400 attacks daily, or one every 0.44 seconds. The surge is attributed to the proliferation of DDoS-for-hire services, which have enabled a flood of attacks.
In earlier quarters, Cloudflare recorded 13.2 million L3 DDoS attacks in Q2 and 10 million in Q1. The dramatic increase highlights the growing availability and use of booter and stresser services, which facilitate numerous low-bandwidth attacks.
Trends and Shifts in Attack Patterns
An intriguing development noted in the report is the 208% increase in short-burst, low-bandwidth attacks under 10 minutes and 1 Gbps. In contrast, hyper-volumetric attacks exceeding 1 Tbps saw a 69% decline, attributed to law enforcement actions against hacking groups earlier this year.
Despite these efforts, new threats, such as Dysphoria and Evooo1Bot, continue to emerge, indicating that the overall threat landscape remains active and evolving.
Sector and Geographical Impact
Industries heavily targeted by these attacks include media, production, publishing, IT services, gambling, and telecommunications. The geographical impact of these threats was most pronounced in the U.S., China, Indonesia, the U.K., and Türkiye. Notably, Canada and Israel have entered the top 10 most targeted nations, with sectors like retail, telecommunications, and marketing facing increased attacks.
Additionally, while Connectionless Lightweight Directory Access Protocol (CLDAP) floods declined, DNS amplification attacks surged by 215%, accounting for 3.43% of all network-layer attacks, signifying a shift in attack methodologies.
Cloudflare’s report underscores the persistent and evolving nature of DDoS threats, emphasizing the need for robust cybersecurity measures across vulnerable industries. As new variants and attack methods continue to surface, organizations must remain vigilant and proactive in their defense strategies.
