A recent report released by Cloudflare Inc.’s Cloudforce One threat intelligence unit indicates a significant reduction in the largest distributed denial-of-service (DDoS) attacks, which decreased by nearly 69% in the third quarter of 2026. In contrast, network-layer attacks surged overall, more than tripling from the previous year, totaling 18.2 million.
The “Cloudflare DDoS Threat Report 2026 Q3” reveals that there were 251 attacks exceeding 1 terabit per second between July and September. This follows the second quarter’s report of 805 such attacks, which was marked by a sixfold increase from earlier in the year. Cloudflare attributes this decline in high-profile attacks to law enforcement actions in 2026 that targeted four major botnets composed of compromised Internet of Things (IoT) devices.
In March, the U.S. Department of Justice announced the disruption of the Aisuru, Kimwolf, JackSkid, and Mossad botnets, accompanied by actions taken by Canadian and German authorities against individuals allegedly involved. Despite this progress, Cloudflare’s analysis indicates that IoT botnets remain a persistent and high-volume threat, with newer variants such as Dysphoria and Evooo1Bot already emerging.
August was particularly notable for Mirai-class traffic, which reached 57.23 petabytes. The longest recorded Mirai attack during the quarter commenced on August 19 and lasted for 49.7 hours.
Among the reported 18.2 million attacks, the vast majority were smaller in scale, averaging approximately 8,226 attacks per hour, with 96% concluding within 10 minutes. Furthermore, 98% of these attacks maintained a bandwidth of less than 1 gigabit per second. Nevertheless, even attacks of this size are sufficient to incapacitate a server or website, and Cloudflare suggests that this trend aligns with the operational patterns of DDoS-for-hire “booter” services.
Attackers have also shifted their methods; for instance, floods exploiting the Connectionless Lightweight Directory Access Protocol (CLDAP) saw a dramatic increase of 580% in the first half of the year. However, CLDAP comprised just 0.05% of attacks in the third quarter, reflecting a 99.5% decrease from the previous quarter.
Other connectionless protocols rose to prominence as a result. Amplification attacks that utilized the Domain Name System (DNS) increased by 215% from the second quarter, representing 3.4% of the network-layer total. Notably, generic User Datagram Protocol floods grew from 14.1% to 31.3% of attacks. DNS floods remained the most prevalent attack method at 39.3%.
In terms of industry targets, the media, production, and publishing sectors retained the highest incidence of attacks, albeit with only about a quarter of their share from the previous quarter, as attackers diversified their targets. The internet sector advanced from 12th to 6th place, while consumer services climbed nine positions to 8th. Adult entertainment emerged in the top 10 ranking at 9th place after previously standing at 21st.
Geographically, the United States emerged as the most-attacked country in the third quarter, having previously ranked second to China in the first half of the year. Indonesia rose to third place with 2.93% of attacks.
Canada and Israel exhibited the most significant increases in attack occurrences. Canada moved from 16th to 6th place regarding attacks targeting retail, telecommunications, and marketing firms during what the report referred to as “an already turbulent period of bilateral trade disputes.” Conversely, Israel rose seven spots to 10th place, coinciding with sustained DDoS activity in mid-September, which was aggravated by imminent parliamentary elections and the Rosh Hashanah holiday, set against a backdrop of increased hostile cyber warfare activities targeting Israel this year.
Cloudflare’s automated systems effectively detect and mitigate attacks without human intervention. The report emphasizes that this capability is crucial because the majority of attacks in the quarter “end long before a human analyst could see the alert.”