Cloudflare's threat intelligence organization (Cloudforce One) released its periodic Distributed Denial of Service (DDoS) threat report for the third quarter of 2026, based on data from its global network which handles a massive volume of internet traffic.
A Surge in Flash Attacks and a Recession in Super-Sized Attacks
Short-duration DDoS attacks lasting under 10 minutes and remaining below 1 Gbps recorded a remarkable growth of 208% compared to the same period of the previous year. In contrast, ultra-large attacks exceeding one terabit per second experienced a sharp drop of approximately 69% compared to the second quarter, which may be linked to law enforcement campaigns targeting Internet of Things (IoT) botnets earlier in the year.
Rapid Shifts in Attack Vectors
The technical landscape witnessed a striking change represented by the near-complete collapse of Connectionless Lightweight Directory Access Protocol (CLDAP) attacks by 99.5%. Conversely, attackers aggressively pivoted toward other protocols, leading to a 215% jump in Domain Name System (DNS) amplification and a 122% increase in generic User Datagram Protocol (UDP) floods.
What is Practically Changing for Organizations?
The Q3 figures indicate that automated defense systems handled an average of about 8,200 network attacks per hour, confirming that most attacks are now executed and mitigated completely automatically within mere seconds, without human intervention. This shift toward fast and repetitive strikes compels companies and cloud infrastructures to rely on automated monitoring and mitigation systems that operate permanently and instantaneously.
Geographical Targets and Most Affected Sectors
The United States topped the list of countries most targeted by attacks during this period, followed by China in second place and Indonesia in third. Countries such as Canada and Israel also saw a noticeable rise in rankings due to geopolitical tensions and surrounding circumstances. As for sectors, the attackers' focus broadened to include consumer services, internet infrastructure, and entertainment, moving beyond the previous focus limited solely to media organizations.