DDoS attackers are increasingly favoring short, repeated disruptions over prolonged assaults, and Cloudflare says it is stopping thousands of attacks every hour.
The company mitigated 18.2 million network-layer DDoS attacks between July and September 2026, a 208% increase from the same period last year, according to its latest DDoS Threat Report.
Cloudflare also blocked 14.4 trillion malicious HTTP requests associated with DDoS attacks during the quarter. Meanwhile, 96% of network-layer attacks lasted less than 10 minutes, giving security teams little time to respond manually.
The company associates this pattern with DDoS-for-hire services, commonly known as booters, which allow customers to launch attacks against selected targets. The figures suggest that attackers are increasingly relying on repeated, short-lived disruptions rather than concentrating exclusively on massive traffic floods.
Major botnet disruptions have not eliminated the threat
While smaller attacks increased, hypervolumetric DDoS attacks exceeding 1 terabit per second fell from 805 in the second quarter to 251 in the third, a decline of nearly 69%.
The decrease coincides with a March law enforcement operation targeting four major Internet of Things botnets: Aisuru, KimWolf, JackSkid and Mossad. However, Cloudflare noted that new variants, including Dysphoria and Evooo1Bot, have emerged.
Mirai-related activity also remained substantial. Its mitigated traffic peaked at 57.23 petabytes in August, accounting for 46.5% of all network-layer bytes mitigated during the quarter. The longest sustained Mirai attack lasted nearly 50 hours.
Attackers shift toward different DDoS techniques
Cloudflare also reported changes in the methods attackers used during the quarter.
Connectionless Lightweight Directory Access Protocol (CLDAP) reflection attacks declined 99.5% quarter over quarter, accounting for just 0.05% of network-layer attacks. DNS amplification attacks increased 215%, representing 3.43% of incidents.
Other UDP floods also became more prevalent, with their share rising from 14.06% to 31.31%.
These changes show how quickly attackers can switch between available attack methods. Disrupting one technique or taking down a botnet does not necessarily remove the infrastructure or demand behind DDoS attacks.
Businesses face a narrower response window
The changing attack pattern creates a practical challenge for IT and security teams. When most incidents end within 10 minutes, manually investigating alerts and adjusting network defenses may take longer than the attacks themselves.
Organizations running customer portals, online transactions, cloud applications and other internet-facing services need automated detection and mitigation that can respond without waiting for human intervention.
This also raises the importance of reviewing protection beyond bandwidth capacity. Defenses must account for repeated smaller attacks that exhaust server resources, alongside occasional high-volume floods.
How businesses can defend against shorter DDoS attacks
The changing attack pattern creates a practical challenge for IT and security teams. When most incidents end within 10 minutes, manually investigating alerts and adjusting defenses may take longer than the attacks themselves.
For customers, the consequences may appear as failed checkouts, login timeouts, or intermittent service interruptions rather than a prolonged outage. Even relatively small attacks can disrupt services that lack sufficient protection.
Businesses should review their DDoS defenses and ask hosting or network providers three questions:
- Does detection and filtering happen automatically, or does a person have to read an alert first?
- Is protection always on?
- How does the provider handle repeated short attacks?
Cloudflare says every service on its network gets free, unmetered DDoS protection across 330-plus cities and 500 Tbps of capacity.
IT teams should also review exposed DNS resolvers and directory services that attackers could abuse for reflection or amplification attacks.
Hosting and network providers can use threat intelligence feeds, including Cloudflare's DDoS Botnet Threat Feed, to identify infrastructure associated with abusive traffic.
The findings reinforce the need for automated protection that responds quickly to attacks of different sizes, rather than defenses designed only for prolonged, high-volume incidents.
Other news: Sony Network Communications has disclosed a data breach affecting approximately 2.59 million So-net and plala customer records in Japan, along with passwords for 54,401 email accounts.