In the first half of 2026, Cloudflare detected a 519% surge in hyper-volumetric DDos attacks across its network. These attacks were driven heavily by DNS and CLDAP reflection vectors. This report breaks down how major geopolitical conflicts reshaped the global cyber threat landscape.
Cloudflare mitigated 805 hyper-volumetric DDoS attacks exceeding 1 Tbps in Q2 2026—a 519% quarter-over-quarter surge—yet over 90% of all attacks ended in under ten minutes. 👇
Security teams usually prepare for drawn-out network battles, but modern volumetric DDoS strikes fast and vanishes. Some record-breaking 1 Tbps assaults last only 35 seconds. That leaves zero window for human analysts to respond, yet the traffic spike triggers TCP retransmissions, application timeouts, and routing instability that takes hours or days to clean up.
To survive these bursts, Cloudflare relies on automated, always-on mitigation across its edge network while tracking a massive industry shift: attackers are abandoning direct botnet floods to abuse vulnerable UDP server protocols instead.
Attackers prefer reflection and amplification vectors because UDP is connectionless and skips the standard handshake. This lets an attacker forge the source IP header of a packet to make it look like it came from their target.
In H1 2026, Connectionless LDAP (CLDAP) floods surged 580% using this technique. Attackers craft tiny query packets with a spoofed source IP and send them to publicly exposed Active Directory domain controllers listening on UDP port 389. The domain controllers process the queries and bounce their replies directly to the victim. Because directory responses contain detailed data, the domain controllers send back payloads tens to hundreds of times larger than the original query.
DNS attacks followed a similar pattern, making up 34.3% of all network-layer attacks. Attackers either send raw floods at authoritative DNS servers to burn query capacity—making the domain's "phonebook" completely dark—or send spoofed requests to open DNS resolvers so those resolvers reflect inflated answers straight to the target.
In total, Cloudflare mitigated 23.2 million network-layer attacks and 29.64 trillion HTTP DDoS requests in the first half of 2026—averaging 5,343 network attacks every hour. To fight back at the source, Cloudflare now distributes automated threat feeds to over 800 global network operators to help providers identify and tear down abusive botnet nodes.
NayaRead shows a summary and links to the original article. The full article is hosted on blog.cloudflare.com.