cyber.hendryadrian.com
Security Report · bleepingcomputer.com

Cloudflare Reports Fivefold Rise in DDoS Attacks Above 1 Tbps in Q2

· Original article ↗

Summary

Cloudflare reports more than 800 network-layer DDoS attacks above 1 Tbps in Q2 2026, up over fivefold from Q1. Its H1 findings also highlight rising DNS and reflection/amplification attacks.

Key points

  • Cloudflare says it mitigated more than 800 network-layer DDoS attacks above 1 Tbps in Q2, a 519% increase from Q1.
  • In H1 2026, Cloudflare recorded 23.2 million network-layer attacks and 29.64 trillion malicious HTTP requests.
  • DNS floods accounted for 40% of network-layer attacks in Q2; CLDAP floods rose 881.9% quarter over quarter.
  • Cloudflare reported a record 31.4 Tbps attack launched by the Aisuru/Kimwolf botnet.
  • DDoS activity peaked in April and declined afterward; Cloudflare tentatively attributed the decline to Operation PowerOFF, which led to four arrests and 53 domain takedowns.
  • Media, Production, and Publishing received the largest share of mitigated HTTP DDoS requests in H1, while government-sector activity also increased.

Article Details

Publisher
Cloudflare
Report Period
Q1 and Q2 2026; H1 2026
Scope
Cloudflare's observed and mitigated DDoS activity, attack types, and affected sectors.
Sample Size
23.2 million network-layer DDoS attacks and 29.64 trillion malicious HTTP requests mitigated in H1 2026.
Key Statistics
  • Cloudflare mitigated more than 800 network-layer DDoS attacks exceeding 1 Tbps in Q2 2026, up 519% quarter over quarter from 130 in Q1.
  • In H1 2026, Cloudflare mitigated 23.2 million network-layer DDoS attacks and 29.64 trillion malicious HTTP requests.
  • An attack attributed to the Aisuru/Kimwolf botnet peaked at 31.4 Tbps and 200 million requests per second.
  • Operation PowerOFF resulted in four arrests, 53 domain takedowns, and warnings sent to 75,000 users of DDoS-for-hire services.
  • DNS floods accounted for 40% of network-layer attacks in Q2 2026, up from 25.7% in Q1.

MITRE ATT&CK

T1498.001 · Direct Network FloodThe report describes network-layer flood attacks, including DNS, CLDAP, and UDP floods.T1498.002 · Reflection AmplificationThe report describes DNS reflection and amplification attacks.

Malware

Aisuru/KimwolfThe report highlights rising DNS-based and reflection/amplification attacks, with the Aisuru/Kimwolf botnet recently launching a record 31.4 Tbps attack and Operation PowerOFF disrupting DDoS-for-hire services.

Vendors

CloudflareCloudflare mitigated more than 800 network-layer DDoS attacks above 1 Tbps in Q2, a more than fivefold jump from Q1, while also handling 23.2 million network-layer attacks and 29.64 trillion malicious HTTP requests in

Industries

GovernmentThe government sector also saw a notable increase, which Cloudflare linked to geopolitical events, including the US-Israeli military operation against Iran, prompting heightened hacktivism.Media, Production, and PublishingFinally, regarding the targets, Cloudflare reports that the Media, Production, and Publishing sector received the largest share of mitigated HTTP DDoS requests during H1 2026, at 14.2%.

Related Articles