Cybercriminals are significantly increasing the frequency of distributed denial-of-service (DDoS) attacks, with threat actors launching approximately 8,226 network-layer attacks every hour, according to Cloudflare’s latest threat intelligence report.
The web infrastructure and cybersecurity company revealed that it automatically mitigated 18.2 million network-layer (Layer 3) DDoS attacks and 14.4 trillion HTTP DDoS requests during the third quarter of 2026. This represents an average of approximately 197,400 network-layer attacks per day, or one attack every 0.44 seconds.
Network-Layer DDoS Attacks Continue to Increase
Cloudflare’s latest figures highlight a significant increase in DDoS activity compared with previous quarters.
The company recorded 13.2 million Layer 3 DDoS attacks in the second quarter of 2026, compared with 10 million attacks in the first quarter. The latest quarterly total of 18.2 million demonstrates how rapidly the threat landscape is evolving.
According to Cloudflare, much of this increase is associated with DDoS-for-hire platforms, commonly known as booter or stresser services. These services allow attackers to launch large volumes of disruptive traffic without operating their own attack infrastructure.
The Cloudforce One threat intelligence team highlighted another concerning development in its quarterly DDoS Threat Report, shared with The Hacker News.
“Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%,” the team reported.
These shorter attacks can be particularly challenging for organizations because they may occur frequently and end before security teams can fully investigate or respond.
Hyper-Volumetric DDoS Attacks Decline
Despite the overall increase in attack activity, Cloudflare observed a notable decline in extremely large-scale DDoS campaigns.
Attacks exceeding 1 terabit per second (Tbps) dropped by 69% compared with the previous quarter. The number of such attacks decreased from 805 in Q2 2026 to just 251 in Q3.
Cloudflare suggested that law enforcement operations targeting major DDoS-for-hire botnets and services, including AISURU, KimWolf, JackSkid, and Mossad, earlier in March may have contributed to this decline.
However, the company cautioned that the threat has not disappeared.
New variants, including Dysphoria and Evooo1Bot, continue to emerge, highlighting the ongoing evolution of DDoS infrastructure and attack techniques.
DNS Amplification Attacks Rise by 215%
Cloudflare also identified changes in the techniques used by attackers.
Connectionless Lightweight Directory Access Protocol (CLDAP) flood attacks declined during the quarter, while DNS amplification attacks increased substantially.
DNS amplification activity surged by 215%, accounting for 3.43% of all network-layer DDoS attacks recorded during Q3 2026.
DNS amplification is a reflection-based attack technique in which attackers abuse DNS servers to generate significantly larger volumes of traffic toward targeted systems. This can overwhelm network resources and disrupt the availability of online services.
Media, Technology, and Telecommunications Among the Most Targeted Industries
Cloudflare’s report also identified the industries experiencing the highest levels of DDoS activity.
The most frequently targeted sectors during the third quarter included:
- Media, production, and publishing
- Information technology and services
- Gambling and casinos
- Computer software
- Telecommunications providers
These industries often depend on continuously available online platforms and network infrastructure, making service disruptions particularly damaging.
United States and China Among the Most Attacked Countries
Geographically, the United States, China, Indonesia, the United Kingdom, and Türkiye were the most frequently targeted countries during Q3 2026.
Canada and Israel also entered the top 10 ranking.
Cloudflare noted that attacks against Canada’s retail, telecommunications, and marketing sectors contributed to the country’s increased position in the rankings.
DDoS Threats Continue to Evolve
Cloudflare’s third-quarter findings demonstrate that DDoS attacks remain a major cybersecurity challenge, even as law enforcement efforts disrupt some large-scale attack operations.
While hyper-volumetric attacks have declined, the sharp increase in short-duration, low-bandwidth attacks and DNS amplification activity indicates that threat actors are adapting their methods.
Organizations should continue strengthening their DDoS protection strategies through traffic monitoring, network-layer filtering, automated mitigation, and resilient infrastructure.
As DDoS-for-hire services and emerging botnet variants continue to evolve, businesses must prepare for attacks that are not only larger in scale but also more frequent and difficult to predict.
