Cloudflare Q3 2026 Report Highlights Short DDoS Swarms
Cloudflare mitigated an average of over 8,200 Distributed Denial of Service (DDoS) attacks per hour during the third quarter of 2026 as threat actors pivoted toward shorter, high-frequency strikes.
Radwan AbdulhadiEditor and technology writer
The Rise of Short-Burst Swarms and Botnet Shifts
The 26th edition of the Cloudflare DDoS Threat Report, produced by Cloudforce One, covers the third quarter of 2026 and reveals a fundamental transformation in how attackers operate. While overall attack counts mounted across the global Cloudflare network, the nature of the traffic shifted dramatically toward short-burst, low-bandwidth assaults that last under 10 minutes and stay under 1 Gbps.
According to the data, short-burst, low-bandwidth attacks surged by 208% compared to the same quarter in 2025. These frequent, smaller strikes often reflect the operational signature of DDoS-for-hire booter services targeting industries such as computer software, gambling and casinos, and information technology.
Decline in Hyper-Volumetric Attacks and IoT Disruption
In stark contrast to the surge in smaller swarms, hyper-volumetric network-level attacks exceeding 1 Tbps plummeted by nearly 69% from the previous quarter. Network-level hyper-volumetric attacks dropped to 251 incidents in Q3, down from 805 in Q2.
Security analysts attribute this steep drop partly to law enforcement action earlier in the year that disrupted four major Internet of Things botnets: Aisuru, KimWolf, JackSkid, and Mossad. Nevertheless, IoT botnets remain a durable threat as the ecosystem churns through alternative variants such as Dysphoria and Evooo1Bot.
Vector Shifts: CLDAP Collapse and UDP Surges
Threat actors also altered their reflection and amplification techniques during the third quarter. Most notably, CLDAP attacks experienced a staggering collapse of 99.5% quarter-over-quarter after surging during the first half of the year.
With connectionless lightweight directory access protocol vectors largely abandoned, attackers pivoted toward other connectionless protocols. This shift drove a 215% increase in DNS amplification and a 122% surge in general UDP floods across the network.
Target Industries and Geographic Shifts
Geographic targeting shifted during Q3 2026 as well, with the United States reclaiming the position of most-attacked location, followed by China and Indonesia. Meanwhile, Canada and Israel experienced sharp rises in targeted attacks, climbing ten and seven spots respectively amid regional geopolitical tensions and domestic events.
Operationally, the focus of Distributed Denial of Service (DDoS) attacks moved away from traditional media organizations toward a more diverse array of targets, including consumer services, internet infrastructure, and adult entertainment industries.
Mitigation Scale and Ongoing Defense Efforts
During the third quarter, Cloudflare systems autonomously mitigated 18.2 million network-layer DDoS attacks alongside 14.4 trillion HTTP DDoS requests. This activity equates to an average of approximately 8,226 network-layer attacks every single hour, or roughly one attack every 0.44 seconds.
To combat these persistent threats, the company continues to provide free threat feeds and unmetered protection across its infrastructure, helping hosting providers and network operators identify and neutralize malicious botnet nodes worldwide.
Sources
- Cloudflare BlogCloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants
Continue chronologically
Related entity coverage
Related stories
Cloudflare Introduces Threat Signals for Free
Cloudflare launches Threat Signals and expands access to its Threat Events Platform, bringing agentic open-source intelligence to every account.
Cloudflare Details Agentic Security Operations Harness
Cloudflare Managed Defense introduces an AI agent harness combining Workers, deterministic evidence collection, and global telemetry for threat analysis.
Cloudflare Unveils Adaptive Application Security Framework for AI Era
Cloudflare has introduced an adaptive security framework to combat AI-driven cyber attacks, connecting risk discovery, agent governance, runtime protection, and intelligence.
Cloudflare Cuts DNS Build Delay and Memory Usage
Cloudflare has introduced a targeted DNS build planner that cuts full builds by 40%, lowers peak memory by 85%, and halves overall build delay.
