EN PT-BR
← Voltar ao feed
medium media gambling information technology software consumer services internet infrastructure adult entertainment retail telecommunications marketing technology

Cloudflare Q3 2026 DDoS report: 18.2M network-layer attacks, short booter-style bursts up 208%, 1 Tbps+ attacks down 69%

3 fonte(s) · 3 atualização(ões) · publicado 29/10/2026 09:55 · coletado há 1 dia

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 01/11/2026 00:01; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ gbhackers.com ↗ blog.cloudflare.com ↗

Cloudflare's Cloudforce One Q3 2026 DDoS Threat Report (July–September 2026) says the company mitigated 18.2 million network-layer DDoS attacks (272.6 PB) and 14.4 trillion HTTP DDoS requests (95.1 PB), about 8,226 network-layer attacks per hour, or one every 0.44 seconds (blog.cloudflare.com, gbhackers.com, thehackernews.com). Network-layer volume rose about 38% quarter over quarter, from 13.2 million in Q2 and 10.0 million in Q1 2026 (thehackernews.com). Activity is dominated by short, low-bandwidth floods (under 10 minutes and 1 Gbps) consistent with DDoS-for-hire (booter/stresser) services, and these surged 208% (thehackernews.com). Hyper-volumetric attacks above 1 Tbps fell about 69% from Q2 (805 to 251), which coincides with law enforcement actions in March against the Aisuru, KimWolf, JackSkid and Mossad IoT botnets (thehackernews.com). Cloudflare warns the threat is not neutralized, citing new variants such as Dysphoria and Evooo1Bot. Vector mix shifted sharply: CLDAP reflection collapsed 99.5% while DNS amplification rose 215%. The United States reclaimed the top attacked location from China, followed by China and Indonesia. Sources differ on how firmly the takedowns are linked to the drop in large attacks, and gbhackers.com describes the 208% figure differently (see Conflicting Reports).

Detalhes técnicos

  • 96% of attacks ended in under 10 minutes and 98% stayed under 1 Gbps, enough to overwhelm an unprotected server (blog.cloudflare.com, gbhackers.com).
  • The most targeted sectors for short-burst, high-count campaigns were computer software, gambling and casinos, and IT (blog.cloudflare.com, gbhackers.com).
  • Overall most targeted industries: media, production and publishing; information technology and services; gambling and casinos; computer software; telecommunications providers (thehackernews.com).
  • Law enforcement takedowns (March 2026, per thehackernews.com) dismantled Aisuru, KimWolf, JackSkid and Mossad. New variants Dysphoria and Evooo1Bot have emerged (blog.cloudflare.com, thehackernews.com). Evooo1Bot combines Mirai-style flooding, proxy relaying, credential theft and exploit-driven router propagation. Mirai-derived botnets are evolving into combined DDoS and proxy platforms (gbhackers.com).
  • Mirai-classified mitigation peaked in August at 57.23 PB, 46.5% of all mitigated network-layer bytes. The longest sustained Mirai attack lasted 49.7 hours (Aug 19–21) (blog.cloudflare.com).
  • CLDAP reflection (UDP/389, spoofed queries against exposed domain controllers) fell to 0.05% of attacks after a +580% surge in H1 (blog.cloudflare.com, gbhackers.com).
  • DNS amplification rose 215% to 3.43% of network-layer attacks, abusing open resolvers (blog.cloudflare.com, gbhackers.com, thehackernews.com). Other UDP floods grew from 14.06% to 31.31% (blog.cloudflare.com, gbhackers.com).
  • Industries: Media, Production & Publishing stayed #1 but at roughly a quarter of its Q2 share. Internet infrastructure rose to #6, Consumer Services to #8 and Adult Entertainment to #9 (blog.cloudflare.com).
  • Geography: US #1, China #2, Indonesia #3 (2.93%), Canada #6 (up from #16, +10 positions), Israel #10 (+7 positions) (blog.cloudflare.com, gbhackers.com). The U.K. and Türkiye also rank in the top five (thehackernews.com). Canada's rise was driven by attacks on its retail, telecommunications and marketing sectors (thehackernews.com).

Remediação

  • Deploy always-on, autonomous DDoS detection and mitigation, because most attacks end before a human analyst can respond (blog.cloudflare.com, gbhackers.com).
  • Secure or restrict exposed CLDAP (UDP/389) services and open DNS resolvers so they cannot be used as amplifiers (gbhackers.com).
  • Harden internet-facing routers and IoT devices against Mirai-class infection (gbhackers.com).
  • Service providers can subscribe to Cloudflare's free DDoS Botnet Threat Feed (800+ networks enrolled) to identify and take down abusive IPs and accounts (blog.cloudflare.com, gbhackers.com).

Relatos divergentes

  • Scope of the 208% figure: Cloudflare's own report (blog.cloudflare.com) ties the 208% rise to short, low-bandwidth booter-style attacks, and thehackernews.com likewise applies it to short-burst attacks under 10 minutes and 1 Gbps. gbhackers.com presents it as a 208% year-over-year increase in overall attack frequency. The Cloudflare report is the primary source and should be treated as authoritative, and the more recent thehackernews.com account agrees with it.
  • Takedowns and the drop in large attacks: blog.cloudflare.com says the decline in 1 Tbps+ attacks is likely linked to the botnet takedowns, and thehackernews.com also says "likely because of" the March law enforcement actions. gbhackers.com states that Cloudflare did not assert causality. The link should be treated as probable but unconfirmed.

Linha do tempo

  1. thehackernews.com ↗ · pub. 31/10/2026 01:56 · coletado 31/10 04:00

    Cloudflare Q3 2026: 18.2M network-layer DDoS attacks mitigated, up 38% quarter over quarter, driven by booter services

    ler a análise desta fonte

    Cloudflare reported that it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in Q3 2026. That equals about 8,226 attacks per hour, or one every 0.44 seconds. L3 volume rose from 13.2 million in Q2 and 10.0 million in Q1 2026, an increase linked to DDoS-for-hire booter/stresser services. Short-burst, low-bandwidth attacks (under 10 minutes and 1 Gbps) surged 208%, while hyper-volumetric attacks above 1 Tbps fell 69% (805 in Q2 to 251 in Q3), likely because of law enforcement actions in March against AISURU, KimWolf, JackSkid and Mossad. Cloudflare warns the threat is not neutralized, citing new variants such as Dysphoria and Evooo1Bot.

    Technical Details

    • DNS amplification attacks jumped 215%, reaching 3.43% of all network-layer attacks, while CLDAP floods declined.
    • Most targeted industries: media, production and publishing; information technology and services; gambling and casinos; computer software; telecommunications providers.
    • Most attacked countries: the U.S., China, Indonesia, the U.K. and Türkiye. Canada and Israel entered the top 10, driven by attacks on Canada's retail, telecommunications and marketing sectors.
    • The data comes from the Cloudforce One quarterly DDoS Threat Report.
  2. gbhackers.com ↗ · pub. 30/10/2026 03:46 · coletado 30/10 04:00

    Cloudflare mitigates 18.2M network-layer DDoS attacks in Q3 2026 as short booter-style floods surge 208%

    ler a análise desta fonte

    Cloudflare reported mitigating 18.2 million network-layer DDoS attacks in Q3 2026 (July–September), a 208% year-over-year increase in attack frequency, alongside 14.4 trillion malicious HTTP requests. Cloudforce One measured roughly 8,226 network-layer attacks per hour, with mitigated traffic of 272.6 PB at the network layer and 95.1 PB at the HTTP layer. The dominant pattern is short, small, high-frequency floods consistent with DDoS-for-hire "booter" services: 96% of attacks ended within ten minutes and 98% stayed below 1 Gbps. Terabit-class attacks fell nearly 69%, from 805 in Q2 to 251 in Q3, coinciding with law enforcement disruption of Aisuru, KimWolf, JackSkid, and Mossad, though Cloudflare did not assert causality. The United States was the most-attacked location, followed by China and Indonesia; Media, Production & Publishing remained the top targeted industry.

    Technical Details

    • CLDAP reflection attacks collapsed 99.5% QoQ to 0.05% of network-layer attacks (abuse of exposed domain controllers on UDP/389 with spoofed sources).
    • DNS amplification rose 215% to 3.43% of attacks, abusing open resolvers.
    • Other UDP floods grew from 14.06% to 31.31%, showing a shift toward connectionless traffic abuse.
    • Mirai-derived botnets continue evolving into combined DDoS and proxy platforms; emerging variants include Dysphoria and Evooo1Bot, the latter combining Mirai-style flooding, proxy relaying, credential theft, and exploit-driven router propagation.
    • Most targeted sectors for high-count campaigns: computer software, gambling/casino, and IT firms. Canada climbed to sixth and Israel to tenth among attacked locations.

    Remediation

    Cloudflare stresses autonomous, always-on detection and mitigation because most attacks finish before manual response is possible. Organizations should secure or restrict exposed CLDAP (UDP/389) services and open DNS resolvers to avoid being used as amplifiers, harden internet-facing routers and IoT against Mirai-class infection, and consider Cloudflare's free botnet threat feed, now used by more than 800 networks.

  3. blog.cloudflare.com ↗ · pub. 29/10/2026 09:55 · coletado 29/10 11:01 primeiro registro

    Cloudflare Q3 2026 DDoS report: 18.2M network-layer attacks, 208% surge in short bursts, 69% drop in 1 Tbps+ events

    ler a análise desta fonte

    Cloudflare's Cloudforce One published its Q3 2026 DDoS Threat Report, covering July–September 2026. The network autonomously mitigated 18.2 million network-layer DDoS attacks (272.6 PB) and 14.4 trillion HTTP DDoS requests (95.1 PB), averaging ~8,226 network-layer attacks per hour. Short, low-bandwidth booter-style attacks rose 208% year-over-year, while hyper-volumetric attacks above 1 Tbps fell ~69% from Q2 (805 → 251), likely linked to law enforcement takedowns of four large IoT botnets. Vector preferences shifted sharply, with CLDAP reflection collapsing 99.5% and DNS amplification up 215%. The United States reclaimed the top attacked location from China, with Canada and Israel climbing 10 and 7 positions respectively.

    Technical Details

    • 96% of attacks ended in under 10 minutes; 98% stayed under 1 Gbps — enough to overwhelm an unprotected server.
    • Targeted industries for short-burst attacks: computer software, gambling and casinos, IT.
    • Takedowns earlier in 2026 dismantled the Aisuru, KimWolf, JackSkid, and Mossad IoT botnets; new variants Dysphoria and Evooo1Bot have emerged.
    • Mirai-classified mitigation peaked in August at 57.23 PB, 46.5% of all mitigated network-layer bytes; longest sustained Mirai attack lasted 49.7 hours (Aug 19–21).
    • CLDAP reflection (UDP 389, spoofed queries against public domain controllers) fell to 0.05% of attacks after a +580% surge in H1.
    • DNS amplification reached 3.43% of network-layer attacks; other UDP floods grew from 14.06% to 31.31%.
    • Media, Production & Publishing remained #1 industry but at ~a quarter of its Q2 share; Internet infrastructure rose to #6, Consumer Services #8, Adult Entertainment #9.
    • Geography: US #1, China #2, Indonesia #3 (2.93%), Canada #6 (from #16), Israel #10.

    Remediation

    Cloudflare recommends always-on, automated DDoS mitigation, noting most attacks end before a human analyst can respond. Service providers can subscribe to the free DDoS Botnet Threat Feed (800+ networks enrolled) to identify and take down abusive IPs and accounts.