Cloudflare reports 38% rise in network‑layer DDoS attacks in Q3 2026, driven by short‑burst booter services

Cloudflare’s Q3 2026 DDoS landscape

Cloudflare disclosed that its network mitigated 18.2 million layer‑3 (L3) distributed denial‑of‑service (DDoS) attacks and 14.4 trillion HTTP‑based DDoS requests during the third quarter of 2026. This translates to 197,400 attacks per day, or roughly one attack every 0.44 seconds. The company’s threat‑intelligence team, Cloudforce One, attributes the surge – a 38 % increase over Q2 – to a rise in short‑burst, low‑bandwidth attacks launched through DDoS‑for‑hire (booter or stresser) services.

Quarter‑over‑quarter comparison

| Quarter | L3 attacks mitigated | |---------|----------------------| | Q1 2026 | 10.0 million | | Q2 2026 | 13.2 million | | Q3 2026 | 18.2 million |

The data show a steady upward trajectory, with Q3’s volume exceeding Q2 by 5 million attacks. While the total number of attacks grew, the composition of attack types shifted markedly.

Shifts in attack characteristics

• Short‑burst, low‑bandwidth attacks (under 10 minutes, ≤ 1 Gbps) rose 208 %. These attacks are typical of booter services that sell inexpensive, rapid‑fire attacks to a broad customer base.
• Hyper‑volumetric attacks (> 1 Tbps) declined 69 %, dropping from 805 incidents in Q2 to 251 in Q3. Cloudflare links this reduction to coordinated law‑enforcement actions earlier in the year against groups such as AISURU, KimWolf, JackSkid, and Mossad.
• DNS amplification attacks surged 215 %, now representing 3.43 % of all L3 attacks, while CLDAP floods continued to fall.

Targeted sectors and geographies

The most frequently hit industries were:

• Media, production, and publishing
• Information technology and services
• Gambling and casinos
• Computer software
• Telecommunications providers

Geographically, the United States, China, Indonesia, the United Kingdom and Türkiye remained the top five targets. Canada and Israel entered the top‑10, with attacks focusing on Canadian retail, telecommunications and marketing firms.

Emerging threats and law‑enforcement impact

Cloudflare warned that, despite the drop in ultra‑large attacks, new bot variants such as Dysphoria and Evooo1Bot are emerging. The company’s statement suggests these tools may enable attackers to bypass existing mitigation rules or to automate attack generation at scale.

Law‑enforcement actions appear to have curtailed the most massive attacks, but the persistence of short‑burst booter traffic indicates that the threat surface remains broad and inexpensive to exploit.

Practical implications for organisations

• Review DDoS mitigation capacity – Even low‑bandwidth, short‑duration attacks can overwhelm poorly sized edge infrastructure. Companies should verify that their mitigation services can absorb spikes of 1 Gbps for up to ten minutes without service degradation.
• Prioritise DNS security – The 215 % rise in DNS amplification underscores the need for proper DNS server configuration (e.g., response rate limiting, closed recursion) and monitoring of outbound traffic.
• Monitor for new bot signatures – Security teams should stay updated with Cloudflare’s threat‑intel feeds to detect traffic patterns associated with Dysphoria or Evooo1Bot.
• Assess sector‑specific risk – Media, gambling and telecom firms should consider heightened alerting and incident‑response drills, given their ranking among the most targeted sectors.

What is confirmed versus unknown

Confirmed by Cloudflare

• Total L3 attacks (18.2 M) and HTTP requests (14.4 T) for Q3 2026.
• 208 % increase in sub‑10‑minute, ≤ 1 Gbps attacks.
• 69 % drop in > 1 Tbps attacks, linked to specific law‑enforcement actions.
• 215 % jump in DNS amplification attacks to 3.43 % of L3 traffic.
• Top‑targeted industries and countries.

Uncertain or not disclosed

• Exact attribution of individual attacks to specific booter services.
• Detailed technical characteristics of the new Dysphoria and Evooo1Bot variants.
• Whether the observed trends will continue into Q4 2026.

How readers can verify the data

The full quarterly DDoS Threat Report and Cloudflare’s press release are available on The Hacker News website. Readers can consult the original article at: https://thehackernews.com/2026/10/cloudflare-reports-182-million-network.html

For additional context, Cloudflare’s public blog and the Cloudforce One threat‑intel portal regularly publish detailed breakdowns of attack vectors and mitigation statistics.

--- *This article is based solely on the verified information published by The Hacker News on 31 October 2026. No original reporting or interviews were conducted.*