Cloudflare's Cloudforce One threat intelligence unit reported that distributed denial-of-service attacks above 1 terabit per second dropped nearly 69% in the third quarter, even as total network-layer attacks more than tripled year over year to 18.2 million. The findings appear in the Cloudflare DDoS Threat Report 2026 Q3, which counted 251 attacks above 1 terabit per second between July and September, down from 805 in the second quarter.
The second-quarter figure had followed a sixfold rise from the first three months of the year. Cloudflare tentatively attributes the third-quarter decline to law enforcement action earlier this year against four of the largest botnets assembled from compromised internet of things devices. The Justice Department announced in March that Aisuru, Kimwolf, JackSkid and Mossad had been disrupted, with authorities in Canada and Germany also moving against people allegedly behind them. Cloudflare still assesses internet of things botnets as a durable, high-volume threat, noting that new variants such as Dysphoria and Evooo1Bot are already circulating.
August was the busiest month for traffic classified as Mirai, at 57.23 petabytes. The quarter's longest Mirai attack started Aug. 19 and ran for 49.7 hours, according to the report.
Small attacks accounted for most of the quarter's 18.2 million, a rate of about 8,226 an hour. Nearly all ended quickly, with 96% finishing inside 10 minutes, and bandwidth stayed below 1 gigabit per second in 98% of cases. The report notes that a flood of that size is still more than enough to overwhelm a server or website, and Cloudflare reads the overall profile as the signature of DDoS-for-hire booter services.
Attack methods shifted as well. Floods abusing the Connectionless Lightweight Directory Access Protocol grew 580% in the first half of the year, then fell to 0.05% of attacks in the third quarter, down 99.5% from the second quarter. Other connectionless protocols filled the gap: amplification attacks using the Domain Name System rose 215% from the second quarter to 3.4% of the network-layer total, while generic User Datagram Protocol floods climbed from 14.1% of attacks to 31.3%. Plain DNS floods remained the most common method at 39.3%.
Media, production and publishing held the top spot among targeted industries but with only about a fourth of the share it had from April to June, as attackers spread their aim more widely. The internet sector rose to sixth from 12th, consumer services climbed nine places to eighth, and adult entertainment entered the top 10 in ninth after ranking 21st three months earlier. The U.S. was the most-attacked country in the third quarter after finishing second to China in the first half, and Indonesia rose to third with 2.93% of attacks. Canada climbed from 16th to sixth, hitting retail, telecommunications and marketing companies during what the report called an already turbulent period of bilateral trade disputes, while Israel moved up seven places to 10th on sustained DDoS activity in mid-September.
Cloudflare said its systems detect and mitigate attacks without human intervention, which the report describes as necessary given that most attacks in the quarter end long before a human analyst could see the alert.
More cybersecurity news from TechManNews.
