DDoS attacks hit record scale as 1 Tbps+ campaigns become more common
Cloudflare's H1 2026 report shows record DDoS scale, with more 1 Tbps+ attacks, multi-vector campaigns, and hacktivist surges against governments.
Cloudflare's H1 2026 DDoS Threat Report documents record-scale attacks, with a significant increase in campaigns exceeding 1 Tbps and April 2026 peaking at 6.46 trillion requests and 165 PB. Most network-layer attacks stayed small and short — 96.62% under 500 Mbps and 90.60% under 10 minutes — but multi-vector campaigns combining HTTP floods with DNS and CLDAP amplification grew. Operation Epic Fury drove 149 hacktivist DDoS claims against 110 organizations in 16 countries, hitting the government sector hardest, and Brazil overtook the US as the leading attack source country.
- DNS flood and amplification accounted for 34.3% of network-layer attacks; CLDAP floods rose 580% quarter over quarter
- Media, production and publishing was the most targeted sector at 14.2% of mitigated HTTP DDoS requests
- China (22.4%) and the US (18.8%) led Q2 targets; Turkey rose amid NATO summit preparations
- DDoS-for-hire platforms, compromised IoT devices and automation keep lowering the attack barrier
- ATT&CK
- T1498.001 Direct Network FloodT1498.002 Reflection AmplificationT1499.003 Application Exhaustion Flood
- Vendors
- Cloudflare
- Organizations
- Operation Epic Fury
From the original article
3 min read at helpnetsecurity.com
DDoS attacks grew in scale during the first half of 2026, bringing larger traffic floods, shorter attack durations, and increasingly automated campaigns. Cloudflare’s H1 2026 DDoS Threat Report shows threat actors relying on multi-vector techniques and large-scale network-layer attacks to disrupt online services across multiple industries.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.