.jpg "Cloudflare Report Highlights Changing DDoS Attack Trends in Q3 2026")
.jpg)
DDoS attack patterns have undergone a significant shift as a result of the latest Cloudflare DDoS threat report, with cybercriminals increasingly focusing on frequent, short-duration attacks in place of concentrated traffic floods. According to the company, 18.2 million network-layer DDoS attacks were mitigated during the third quarter of 2026, an increase of 208% from the previous period.
It was published on October 29, analyzing attack activity between July and September. Cloudflare's threat intelligence team, Cloudforce One, also reported mitigating 14.4 trillion HTTP DDoS requests during the quarter. There were approximately 8,226 network-layer attacks per hour, which equates to one attack every 0.44 seconds. These findings provide an indication that attackers are altering their operational approaches.
In Q3, Cloudflare recorded 251 attacks exceeding 1 terabit per second (Tbps), compared with 805 in Q3. This represents approximately a 69% decrease in attacks exceeding 1 Tbps.
There was a significant increase in smaller, short-lived attacks as one of the most notable findings. According to Cloudflare, 96% of network-layer DDoS incidents lasted less than 10 minutes, while 98% generated traffic below one gigabyte per second.
Even though these attacks have relatively low bandwidth, they can cause disruptions to websites, servers, and online services, particularly when infrastructures lack network capacity or are inadequately protected.
Security teams that rely on manual investigation and response may have difficulty identifying and resolving these attacks due to their short duration, since attacks may end before analysts can identify and address Cloudflare's incident associated with DDoS-for-hire, commonly referred to as booters or stressers.
The use of such services allows attackers to flood targeted websites without requiring sophisticated attack infrastructure. These campaigns targeted software development, gambling and gaming businesses, as well as information technology companies. As a consequence of law enforcement operations in 2026 that disrupted four major Internet of Things botnets: Aisuru, KimWolf, JackSkid, and Mossad, hyper-volumetric attacks decreased earlier in 2026.
The reduction in compromised connected device threats has not been eliminated, however. Cloudflare has continued to observe emerging IoT botnet variants, including Dysphoria and Evooo1Bot, which indicates the ecosystem continues to operate despite disruption efforts. Additionally, Mirai-classified traffic remained substantial in August, reaching 57.23 petabytes in mitigation.
Organizations should also monitor exposed network services as attack methods change. DNS resolvers and directory services accessible from the public internet can be abused to perform reflection and amplifier attacks. To prevent attackers from exploiting these systems to generate malicious traffic, security teams must ensure that these systems are properly configured and restricted.
It is also evident that Cloudflare's findings point to a broader distribution of DDoS targets.
Although Media, Production & Publishing was the most attacked industry in Q3, the share dropped by approximately a quarter compared to its previous quarter. There was substantial activity in information technology, computer software, telecommunications, as well as internet infrastructure in Q3.
The top ten also included Consumer Services and Adult Entertainment, ranking eighth and ninth respectively. Geographic targeting indicated similar changes.
The United States regained its position as the most attacked country, followed by China, while Indonesia became third with 2.93% of recorded attacks.
Among the sharpest increases occurred in Canada, which moved from 16th to sixth place after attacks targeted retailers, telecommunications companies, service providers, and marketing firms. Furthermore, Israel jumped seven places to reach tenth place after sustained DDoS activity occurred during September.
Cloudflare attributed the increase to heightened tensions in the region and domestic political developments in September.
With the increasing frequency of short-duration attacks, organizations relying on manual incident response face a particular challenge. In the event of a network-layer attack ending within ten minutes, security teams may not have time to investigate alerts and implement countermeasures before the attack ends.
The repeated disruption of online transactions, customer-facing platforms and other internet-based services, regardless of whether or not they cause prolonged outages, can also adversely affect them.
A significant component of modern DDoS protection is automated detection and mitigation, according to Cloudflare. With a global network of more than 330 cities and a reported capacity of 500 Tbps, Cloudflare provides protection across more than 330 cities.
The company provides a free DDoS Botnet Threat Feed that assists hosting providers, cloud platforms and internet service providers in detecting malicious IP addresses and accounts related to botnet activity. Over 800 networks worldwide have enrolled in this service.
DDoS protection must be capable of addressing both high volumes of attacks as well as repeated smaller disruptions, according to Q3 findings.
The presence of new variants and changing traffic techniques continues to pose risks to internet-facing infrastructure, even as law enforcement operations reduce the frequency of some large-scale botnet attacks.
