Cloudflare says network-layer DDoS attacks jumped 38% in the third quarter

Cloudflare said it autonomously blocked 18.2 million network-layer distributed denial-of-service (DDoS) attacks during the third quarter of 2026, a roughly 38% increase over the previous quarter, according to a company report covered by The Hacker News on October 31, 2026. The figures suggest DDoS activity is still climbing even as the very largest attacks became less frequent.

What the report found

According to Cloudflare, it mitigated 18.2 million network-layer (Layer 3/4) attacks and 14.4 trillion HTTP (Layer 7) DDoS requests over the quarter, which works out to roughly 197,400 attacks per day. Network-layer attacks rose from 13.2 million in the second quarter and 10.0 million in the first quarter of 2026. Cloudflare attributed the quarter-on-quarter rise, about 38%, to the growth of DDoS-for-hire "booter" and "stresser" services. The company's Cloudforce One team also reported that short bursts lasting under 10 minutes at 1 Gbps or less "surged by 208%," pointing to a shift toward cheap, rapid attacks.

Technical details

Cloudflare said hyper-volumetric attacks exceeding 1 Tbps actually fell 69%, from 805 in the second quarter to 251 in the third. The report suggested that law-enforcement actions in March against operations it named AISURU, KimWolf, JackSkid, and Mossad may have contributed to that decline, while warning that new variants called Dysphoria and Evooo1Bot mean the threat has not been neutralized. Among attack vectors, CLDAP floods declined while DNS amplification rose 215% and accounted for 3.43% of network-layer attacks, per the company.

Who is affected

Cloudflare listed the most-targeted industries as media, production and publishing; IT and services; gambling and casinos; computer software; and telecommunications. The most-attacked countries were the United States, China, Indonesia, the United Kingdom and Türkiye, the company said, with Canada and Israel entering the top 10 and Canada's retail, telecom and marketing sectors cited as drivers. Türkiye's presence on the list underscores that organizations in the country remain squarely in the path of global DDoS activity.

What to do

The report is a reminder for organizations to confirm that always-on DDoS protection covers both the network and application layers, rather than relying on reactive mitigation. Cloudflare's data on the surge in short, low-bandwidth bursts suggests defenders should not assume that only large-scale floods matter; brief attacks can still disrupt services and may serve as cover or testing for other activity. Teams in frequently targeted sectors and regions, including Türkiye, should review their capacity planning, rate-limiting and upstream provider arrangements against the quarter's trends.