Security Operations

Cloudflare: 18.2m DDoS attacks in Q3, most over before SOCs can react

Cloudflare mitigated 18.2m DDoS attacks in Q3 2026, 96% over in under ten minutes. Why UK defenders need always-on mitigation and new runbooks.

Illustration of a network under a stream of short DDoS traffic bursts, with the headline DDoS attacks now end before analysts react.

Cloudflare’s latest quarterly DDoS figures show attackers trading giant floods for a relentless stream of short, small bursts, nearly all of them finished inside ten minutes. For UK security operations teams, the message is blunt: if mitigation waits for a person to read an alert, it is already too late.

What happened

On 29 October 2026 Cloudflare’s Cloudforce One threat intelligence team released its quarterly DDoS Threat Report, covering July to September. The headline number is 18.2 million network-layer (layer 3 and 4) attacks mitigated across its network, which works out at roughly 8,226 every hour, or one attack about every 0.44 seconds. Alongside that, Cloudflare blocked 14.4 trillion malicious HTTP requests. The Hacker News reports that the network-layer count was 13.2 million in the second quarter and 10.0 million in the first, so the curve is still pointing upwards.

The shape of the attacks matters more than the total. Cloudflare says 96% of network-layer attacks were over in less than ten minutes and 98% never passed 1 Gbps. It describes this high-count, short-duration pattern as characteristic of DDoS-for-hire “booter” or “stresser” services, the cheap rental platforms that let almost anyone point traffic at a chosen target. Computer software, gambling and casino operators, and IT firms were the most frequent targets of these campaigns.

At the other end of the scale, hyper-volumetric attacks above 1 Tbps fell from 805 in the second quarter to 251, a drop of about 69%. Cloudflare links that decline to law enforcement action earlier in 2026 against four large IoT botnets, Aisuru, KimWolf, JackSkid and Mossad, although GBHackers notes the report stops short of claiming a definitive causal link. Either way, replacements are already appearing, with Cloudflare naming two newer IoT botnets, Dysphoria and Evooo1Bot.

The technical picture

The vector mix moved sharply during the quarter. Reflection attacks using CLDAP, which abuse exposed directory services on UDP port 389 and had surged earlier in the year, almost vanished, down 99.5% on the previous quarter and now just 0.05% of the total. Attackers switched to other connectionless techniques: DNS amplification climbed 215% and now accounts for 3.43% of network-layer attacks, while generic UDP floods more than doubled their share, from 14.06% to 31.31%. That kind of rapid rotation tells defenders that blocking one reflection protocol buys little time; the tooling simply moves to the next available amplifier.

Mirai-derived botnets remain the heavy machinery behind much of the traffic. Mirai-classified activity peaked in August at 57.23 PB of mitigated traffic, almost half of all network-layer bytes Cloudflare handled that quarter, and one sustained Mirai attack lasted 49.7 hours, running from 19 to 21 August. The typical attack is short, but not every event will be.

On geography, Cloudflare’s text puts the United States top, with China second and Indonesia third, and Canada climbing ten places to sixth and Israel rising to tenth. According to The Hacker News, the UK sits within the top five most attacked countries alongside Türkiye. Cloudflare’s published text does not state the UK’s position, which appears only in a chart, so that ranking is attributed to The Hacker News rather than confirmed from the primary report.

Key figures from Cloudflare's Q3 2026 DDoS report: 18.2 million attacks, 96% under ten minutes, 98% under 1 Gbps, terabit attacks down 69%, DNS amplification up 215%.

Why it matters for UK organisations

The UK does not need a ranking table to know it is a DDoS target. In January 2026 the NCSC warned that pro-Russia hacktivist groups, naming NoName057(16) and its DDoSia tool, were still going after UK organisations, with local government facing frequent attempts and the activity spreading towards operational technology. Campaigns of that kind closely resemble the high-count, modest-bandwidth floods that Cloudflare now describes as the norm.

The practical problem is timing. Cloudflare puts it starkly: “most attacks end long before a human analyst could see the alert.” A council website, a GP booking portal or a regional retailer’s checkout does not need a terabit flood to fall over; a few minutes of a sub-gigabit burst against an unprotected origin, repeated through the day, is enough to frustrate customers and generate calls. Smaller UK organisations relying on a single ISP link or a directly exposed origin server will feel it most, as their capacity and monitoring are thinnest.

There is also a reporting angle: a short outage that resolves before anyone investigates may never reach the incident log, leaving boards with a misleading picture of how often availability is tested.

Expert view

In my experience, most DDoS response plans I review are written as though the attack will be a single dramatic event: someone notices, rings the provider, mitigation is switched on and everyone writes a post-incident report. Cloudflare’s data describes something else entirely, a background hum of brief disruptions that come and go faster than any human escalation chain. If your runbook begins with “the on-call analyst confirms the attack”, it is describing a world that no longer matches most of the traffic.

That does not make the SOC irrelevant. The analyst’s job moves from switching mitigation on to verifying that automated protection fired correctly, spotting the attacks that slipped past it, and noticing patterns, such as repeated bursts against one service, that may be cover for something else. When we test resilience, the weak points are rarely the CDN or scrubbing service itself; they are the forgotten origin IP addresses, the legacy subdomain that bypasses the proxy, and the VPN concentrator nobody put behind protection. The fall in terabit-class attacks is welcome, but the steady arrival of new IoT botnets suggests takedowns buy months, not permanent relief.

What to do now

  1. Make mitigation always-on. Use upstream protection that detects and drops attack traffic automatically, rather than an on-demand service that someone has to call or trigger. This is the core of the NCSC’s upstream defences advice.
  2. Hide and lock down origins. Make sure public services are reachable only through your protection provider, restrict origin firewalls to the provider’s ranges, and hunt for old DNS records that expose real IP addresses. This maps to the Cyber Essentials firewalls and secure configuration controls.
  3. Close your own amplifiers. Check that you are not running open DNS resolvers, exposed CLDAP or other UDP services that could be abused to attack others, again a secure configuration issue.
  4. Alert on short bursts. Tune monitoring so brief spikes in traffic, error rates or latency are logged and reviewed, even when they resolve on their own. Trend them weekly.
  5. Rewrite the runbook. Following the NCSC’s guidance, plan for degraded but continued service, keep out-of-band administrative access, and define what the SOC checks after an automated mitigation rather than before it.
  6. Test it. The NCSC recommends testing and monitoring defences so you know what attack types and volumes they withstand.
  7. Talk to your ISP and hosts. Confirm what upstream filtering they provide, and if you are a hosting or service provider, consider feeds that flag botnet-linked customers on your network.

Bottom line

Cloudflare’s third-quarter figures confirm that DDoS has become a volume game played in minutes, not a rare siege. UK organisations, from councils to online retailers, should treat automated, always-on mitigation as baseline hygiene, and refocus their SOC playbooks on verification, pattern-spotting and resilience rather than racing to press a button after the attack has already ended.

Sources

Related Posts