DDoS attacks grew in scale during the first half of 2026, bringing larger traffic floods, shorter attack durations, and increasingly automated campaigns. Cloudflare’s H1 2026 DDoS Threat Report shows threat actors relying on multi-vector techniques and large-scale network-layer attacks to disrupt online services across multiple industries.
L3/4 attack-size distribution (bitrate), H1 2026 (Source: Cloudflare)
Network-layer attacks remained a primary driver of activity as hyper-volumetric campaigns capable of generating traffic measured in terabits per second became more common. Cloudflare reported a significant increase in attacks exceeding 1 Tbps, showing the growing prevalence of extremely high-bandwidth campaigns.
“April 2026 was a peak month for DDoS activity and volume, hitting a high of 6.46 trillion requests and 165 petabytes (PB) respectively,” the company said.
“Despite the hyper-volumetric growth, the median DDoS attack Cloudflare mitigated in the first half of 2026 remained short and small with 96.62% of network-layer attacks remaining under 500 Mbps and 90.60% ending in under 10 minutes.”
Application-layer attacks remain a major threat
Application-layer attacks continued to target websites, APIs, and online services using HTTP flood techniques. Cloudflare reported that attackers increasingly combined HTTP floods with network-layer attacks as part of multi-vector campaigns, allowing them to shift attack methods during an incident and complicate mitigation efforts.
Threat actors combined network- and application-layer attacks within the same campaign, shifting attack vectors throughout an incident to increase pressure on defensive systems. By targeting multiple layers simultaneously, attackers can complicate mitigation efforts and increase the likelihood of service disruptions.
DDoS-for-hire platforms, compromised Internet of Things (IoT) devices, and automated attack tools continue to lower the barrier to launching large-scale attacks. These resources allow threat actors to generate significant traffic volumes without building or maintaining their own attack infrastructure.
Critical sectors remain under pressure
Government organizations experienced a sharp increase in HTTP DDoS attacks during the second quarter of 2026. Cloudflare observed the surge following Operation Epic Fury, a period during which security researchers recorded 149 hacktivist DDoS claims targeting 110 organizations across 16 countries within 72 hours. Of the targeted organizations, 47.8% belonged to the government sector.
The media, production & publishing sector ranked as the most targeted industry during both quarters of the first half of 2026, accounting for 14.2% of all mitigated HTTP DDoS requests—nearly four times the share of the second-ranked industry.
Attackers continued to launch short-duration, high-intensity campaigns. Many attacks lasted less than one minute, leaving security teams with little opportunity to respond manually before mitigation was required and demonstrating the value of continuous monitoring and automated defenses
China ranked as the most targeted location accounting for 22.4% of all mitigated HTTP DDoS requests in the second quarter. The United States followed with 18.8%, while Turkey climbed to third after more than doubling its share of global attack traffic.
Cloudflare noted that Turkey’s increase coincided with preparations for the 2026 Ankara NATO Summit, during which Turkish authorities conducted large-scale pre-summit security operations.
Brazil overtook the United States as the leading source country for DDoS attacks during the reporting period, accounting for 14.9% of mitigated DDoS request traffic compared with 13.4% for the United States. The shift was driven by a sharp increase in the second quarter, when Brazil generated 21.4% of all mitigated DDoS request traffic.
Indonesia retained its position as the third-largest source country for DDoS attacks.
DNS floods dominate network-layer attacks
DNS-based attacks remained the most common network-layer attack vector. DNS Flood and DNS Amplification attacks accounted for 34.3% of all network-layer attacks, making them the leading techniques used to disrupt online services.
CLDAP Flood attacks increased 580% quarter over quarter, making the technique the third most common network-layer attack vector during the second quarter of 2026. CLDAP attacks abuse exposed LDAP-over-UDP services to amplify traffic and overwhelm targeted systems.