Cloudflare 2026 Threat Report Highlights Identity Abuse and Record DDoS Attacks
Report discovered via Awesome Annual Security Reports.
Summary
Cloudflare’s 2026 threat report highlights stolen sessions, SaaS integration abuse, and AI-assisted operations. It reports 47.1 million DDoS attacks observed in 2025, including a record 31.4 Tbps flood attributed to Aisuru.
Key points
- Cloudflare reports observing 47.1 million DDoS attacks in 2025, more than double the previous year; an Aisuru UDP flood reached 31.4 Tbps in November.
- An analysis of 450 million emails found nearly 43% failed SPF, over 44% lacked valid DKIM signatures, and 46% failed DMARC.
- The report describes how adversary-in-the-middle phishing kits and infostealers capture authenticated session tokens, allowing attackers to bypass standard MFA and sell access to ransomware operators.
- Cloudforce One links the GRUB1 campaign to abuse of the Salesloft Drift–Salesforce integration, highlighting how compromised SaaS connections can expand access across connected services.
- Cloudforce One identified approximately $123.5 million in explicit financial theft attempts during 2025; the report warns that AI could scale business email compromise through automated thread hijacking.
- The report highlights state-sponsored infrastructure pre-positioning and North Korean remote-worker schemes using fraudulent identities and deepfakes, while forecasting broader AI-assisted attacker automation.
- Recommendations include phishing-resistant MFA, continuous session monitoring, least-privilege SaaS permissions, controls on workforce AI usage, stronger remote-hiring verification, and automated DDoS mitigation.
Article Details
- Publisher
- Cloudflare
- Report Period
- 2025 observations with early 2026 coverage
- Scope
- Global threat analysis covering identity attacks, SaaS supply chains, AI abuse, nation-state operations, cybercrime, and DDoS using Cloudflare telemetry and Cloudforce One investigations.
- Sample Size
- 450 million emails in the email-authentication analysis; no overall report sample size disclosed.
- Key Statistics
- Among 450 million emails analyzed, nearly 43% failed SPF, over 44% lacked valid DKIM signatures, and 46% failed DMARC.
- Cloudforce One identified $123,455,786 in explicit financial theft attempts during 2025; these were attempted theft amounts, not confirmed losses.
- Cloudflare observed 47.1 million DDoS attacks in 2025, more than double the previous year's total; network-layer attacks more than tripled.
- An Aisuru UDP flood reached 31.4 Tbps in November 2025, nearly six times the peak of the largest attack in 2024.
- Cloudflare reports that bots generated 94% of login attempts and that 63% of human logins involved credentials previously compromised elsewhere.
- Recommendations
- Apply strict data loss prevention to AI prompts and use browser-isolated environments for generative AI tools.
- Implement phishing-resistant MFA using FIDO2 or passkeys, continuously monitor sessions, and invalidate sessions exhibiting impossible travel or suspicious device fingerprints.
- Audit SaaS API permissions and apply least privilege to integrations, particularly over-privileged read/write tokens that could enable cross-cloud access.
- Use biometric verification for remote interviews and hardware-based geofencing, cryptographically pairing corporate laptops to the user's physical location.
- Deploy automated, edge-based DDoS mitigation capable of responding within seconds.
MITRE ATT&CK
T1078 · Valid AccountsHellCat reportedly breached Jaguar Land Rover and Telefónica using Jira credentials and session tokens obtained from infostealer logs.T1090.002 · External ProxyAisuru and Kimwolf concealed attack sources by tunneling traffic through residential proxy services.T1091 · Replication Through Removable MediaClumsyToad conducted espionage using USB-borne worms such as SnakeDisk.T1110.004 · Credential StuffingBots tested stolen username and password pairs across thousands of sites per second.T1195.002 · Compromise Software Supply ChainThe Shai-Hulud 2.0 operation used a compromised maintainer's tokens to insert malicious preinstall scripts into maintained npm packages.T1199 · Trusted RelationshipGRUB1 compromised a trusted SaaS integration, demonstrating how integration trust can extend a breach into connected platforms.T1496 · Resource HijackingActors hijacked cloud resources to provision GPU instances for cryptomining.T1498.001 · Direct Network FloodAisuru launched a 31.4 Tbps UDP flood in November 2025.T1499.003 · Application Exhaustion FloodBots targeted expensive application functions, including complex search queries, to exhaust server CPU and memory.T1528 · Steal Application Access TokenAttackers stole maintainer tokens and cloud session tokens to obtain authorized access without repeating the normal authentication process.T1539 · Steal Web Session CookieLumma Stealer and adversary-in-the-middle phishing kits harvested active cookies and authenticated session state.T1557 · Adversary-in-the-MiddlePhishing kits acted as transparent proxies between victims and legitimate services to capture authenticated sessions.T1574.002 · DLL Side-LoadingThe report identifies DLL sideloading among ClumsyToad's techniques across multiple regions.T1621 · Multi-Factor Authentication Request GenerationCallowDuck, identified as Scattered Spider, used MFA fatigue to compromise cloud environments.
Threat Actors
ConvolutedKrillConducts credential theft and uses compromised government accounts to exploit regional trust.CrustyKrillUses SaaS-hosted credential harvesting, high-touch social engineering, and recruitment lures.FoolishSlugDescribed as using a combined espionage and ransomware model to fund the North Korean regime.FrumpyToadUses Google Calendar for cloud-to-cloud C2 and targets multiple regions for espionage and financial gain. The report explicitly identifies APT41 as an alias.HellcatThe report attributes early-2025 breaches of Jaguar Land Rover and Telefónica to this ransomware group using credentials and session tokens from infostealer logs.ICE RELICExplicitly identified as an alias of SleezyShrew; targets government, diplomatic, think-tank, and cloud-provider environments.MuddyWaterExplicitly identified as an alias of MuddyKrill; targets government and private-sector organizations in the Middle East and Southern Europe for espionage and regional influence.Mustang PandaExplicitly identified as an alias of ClumsyToad; targets Southeast Asian governments and international nonprofits, including entities involved in South China Sea policy.NastyShrewUses public paste sites as dead-drop resolvers and focuses on persistence and disruption of Ukrainian critical infrastructure.PatheticSlugUses cloud ecosystems to conceal malicious delivery and poses as journalists to obtain off-the-record information.PunyToadUses encrypted tunneling and exploits edge appliances, including F5 BIG-IP and VMware vCenter, for persistent pre-positioning.PutridSlugUses deepfake video and audio to impersonate executives and deploys trojanized coding challenges.Salt TyphoonTargets telecommunications infrastructure and service providers for interception and persistent access. The report explicitly identifies WimpyToad as its corresponding tracking name.Scattered SpiderExplicitly identified as an alias of CallowDuck; associated with identity and access management abuse and disruption of enterprise and hospitality targets.SleezyShrewUses session hijacking and token theft for persistent access to cloud communications. The report explicitly identifies APT29 as an alias.SPIRE CASTLEExplicitly identified as an alias of FrumpyToad; associated with software supply-chain attacks against US healthcare, technology, and retail targets.UNC6395Investigated for compromising trusted SaaS integrations, including the Salesloft Drift connection to Salesforce, and using automated credential discovery and AI-assisted navigation.Volt TyphoonExplicitly identified as an alias of DazedToad; associated with persistent access to energy, water, communications, transportation, military, and utility infrastructure.
Malware
Aisurucapacity**: Hyper-volumetric distributed denial-of-service (DDoS) attacks, fueled by massive botnets like Aisuru, have established a record-breaking 31.4 Tbps baseline.EmotetQakbot and Emotet. These bots do not simply lookKimwolfnetworks like Kimwolf to continue expanding, makingLummaC2Stealer (LummaC2), a premier example of the malware-as-a-service (MaaS) model. Lumma represents theMantisbotnets like the dismantled 911 S5 or the high-compute Mantis botnet, which utilizes hijackedQakbotQakbot and Emotet. These bots do not simply lookSnakeDisk- **ClumsyToad**: High-frequency regional espionage using localized lures and USB-borne worms like SnakeDisk.
Vendors
F5- **PunyToad**: Specializes in the exploitation of edge network appliances (F5 BIG-IP, VMware vCenter) for persistent pre-positioning.Microsoft[^2]: Breach of AT&T, Verizon, Lumen, and the July 2025 Microsoft SharePoint compromise.SalesforceThrough our investigation into the threat actor **GRUB1**, we have seen how a single compromise of a trusted integration — such as the Salesloft Drift connection to Salesforce — can create a dangerous ripple effect.VMware- **PunyToad**: Specializes in the exploitation of edge network appliances (F5 BIG-IP, VMware vCenter) for persistent pre-positioning.
Products
F5 BIG-IP- **PunyToad**: Specializes in the exploitation of edge network appliances (F5 BIG-IP, VMware vCenter) for persistent pre-positioning.Jiraorganizations, including Jaguar Land Rover and Telefónica, specifically by leveraging Jira credentials and sessionMicrosoft 365 Apps for EnterpriseMicrosoft 365, OneDrive, and SharePoint accounts to enable wide-Microsoft RDWebLummaC2 harvesting credentials for Citrix, Microsoft RDWeb, and browser-based VPNs.OpenCode- [Case study: Deconstructing the OpenCode exploit chain through vulnerability analysis](#case-study-deconstructing-the-opencode-exploit-chain-through-vulnerability-analysis)SalesforceThrough our investigation into the threat actor **GRUB1**, we have seen how a single compromise of a trusted integration — such as the Salesloft Drift connection to Salesforce — can create a dangerous ripple effect.Salesloft DriftThrough our investigation into the threat actor **GRUB1**, we have seen how a single compromise of a trusted integration — such as the Salesloft Drift connection to Salesforce — can create a dangerous ripple effect.VMware vCenter- **PunyToad**: Specializes in the exploitation of edge network appliances (F5 BIG-IP, VMware vCenter) for persistent pre-positioning.
Tools
Countries
China- [China: A sophisticated model of infrastructure pre-positioning and cloud-native stealth](#china-a-sophisticated-model-of-infrastructure-pre-positioning-and-cloud-native-stealth)Iran- [Iran: High-level credential theft and lateral movement via compromised government infrastructure](#iran-high-level-credential-theft-and-lateral-movement-via-compromised-government-infrastructure)Israel| widespread use of high-profile | across the Middle East (Israel, Saudi | |Japanutility infrastructure. hubs (Singapore / Japan) to High-tech manufacturing andNorth Korea- [North Korea: Identity-driven infiltration and analytical parasitism](#north-korea-identity-driven-infiltration-and-analytical-parasitism)Russia- [Russia: Blurring the line between digital espionage and operational support](#russia-blurring-the-line-between-digital-espionage-and-operational-support)Singaporeutility infrastructure. hubs (Singapore / Japan) to High-tech manufacturing andTaiwan(Taiwan / South China Sea), they simultaneously target Americas and EMEA for intellectualUkrainefor disruptive cyber operations linked to the war in Ukraine and shiftingUnited StatesThe Americas, particularly the United States, remains the most targeted
Industries
Critical infrastructure- **State-sponsored pre-positioning is compromising critical infrastructure resilience**: Chinese threat actors, notably Salt Typhoon and Linen Typhoon, are prioritizing North American telecommunications, government,Energy| financial gain | (energy, water, communications, | |financeOrganizations in energy, finance,Government- [Iran: High-level credential theft and lateral movement via compromised government infrastructure](#iran-high-level-credential-theft-and-lateral-movement-via-compromised-government-infrastructure)Healthcarehealthcare, tech, and retail sectors this group focuses on pre-positioning ransomware-as-a-service (RaaS)IT servicesSalt Typhoon and Linen Typhoon, are prioritizing North American telecommunications, government, and IT services for persistent pre-positioning.ManufacturingThe targeting of “critical continuity” has also intensified, with manufacturing and criticalsemiconductor| Alias / AKA: | Alias / AKA: | semiconductor sectors are the |TelecommunicationsChinese threat actors, notably Salt Typhoon and Linen Typhoon, are prioritizing North American telecommunications, government, and IT services for persistent pre-positioning.Transportation| | transportation) | Ransomware service maturity |