Cloudflare<\/a> recorded 935 network-layer DDoS attacks exceeding 1 Tbps in H1 2026. Between the first and second quarters alone, attacks above this threshold surged by 519 percent. This sharp jump suggests attackers are scaling up their firepower rapidly, and organisations need to prepare accordingly.<\/p>\n\n\n\nGeopolitical conflict also played a direct role in shaping attack patterns. Following military strikes involving Israel, the US, and Iran in late February, the government sector jumped 20 places, moving from #29 in Q1 to #9 in Q2. This was the largest single industry movement recorded all year, and it illustrates how quickly digital threats can follow real-world events.<\/p>\n\n\n\n
Major events attracted attacker attention too. Turkey climbed to the #3 most-attacked country in Q2, as attack traffic more than doubled during security preparations for the Ankara NATO Summit. Meanwhile, the media, production and publishing industry remained the most targeted sector overall. It topped the list in both quarters, absorbing 14.2 percent of all mitigated HTTP DDoS traffic, largely amid global unrest and World Cup coverage.<\/p>\n\n\n\n
The methods attackers use are also shifting. DNS-based attacks climbed from 25.7 percent to 40 percent of all network-layer attacks quarter over quarter. Additionally, CLDAP floods, which abuse Active Directory LDAP-over-UDP endpoints, surged by 881.9 percent to become the third most common vector in Q2. Together, these shifts show that adversaries are diversifying their techniques and probing different layers of the network stack.<\/p>\n\n\n\n
Not all the news was negative, though. April marked the peak month for DDoS activity, with 6.46 trillion requests recorded. After that, attack volumes dropped off noticeably. Cloudflare attributes part of this decline to Operation PowerOFF, a multi-nation law enforcement crackdown targeting DDoS infrastructure.<\/p>\n\n\n\n
For organisations in the Middle East and Africa, the findings carry particular weight. As governments, financial institutions, media companies and businesses across the region accelerate their digital transformation efforts, service availability has become a critical concern.<\/p>\n\n\n\n
“The latest DDoS data shows that organisations in the Middle East and Africa cannot view availability as a purely technical concern,” said Ercan Aydin, AVP, Middle East, T\u00fcrkiye & Africa, at Cloudflare. “In a region where geopolitical developments can quickly translate into digital disruption, organisations need to be prepared for attacks that can escalate in both scale and sophistication with little warning. The surge in hyper-volumetric attacks, alongside the growing use of DNS-based vectors, reinforces the need for always-on, intelligent protection that can detect and mitigate attacks before they impact critical services.”<\/p>\n\n\n\n
Overall, the report makes clear that large-scale volumetric attacks remain a major threat. At the same time, the rise of DNS-based attacks and CLDAP floods shows attackers are constantly adapting. Consequently, organisations must consider the wider threat environment, especially during periods of heightened geopolitical tension or major international events, when planning their defences.<\/p>\n\n\n\n
Cloudflare’s network automatically detects and mitigates threats across the network, application, and transport layers. As DDoS attacks continue to grow in scale, frequency, and sophistication, this kind of always-on protection is becoming essential for organisations that want to keep critical services online.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Cloudflare has released its DDoS Threat Report for the first […]<\/p>\n","protected":false},"author":58,"featured_media":107118,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[1595,9621],"tags":[314],"contributor":[9732],"class_list":["post-107119","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-emerging-technologies","tag-cybersecurity-2","contributor-news-desk"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2026\/09\/Cloudflare-1.jpg","author_info":{"display_name":"Lubna","author_link":"https:\/\/techxmedia.com\/en\/author\/lubna\/"},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/posts\/107119","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/users\/58"}],"replies":[{"embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/comments?post=107119"}],"version-history":[{"count":1,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/posts\/107119\/revisions"}],"predecessor-version":[{"id":107120,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/posts\/107119\/revisions\/107120"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/media\/107118"}],"wp:attachment":[{"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/media?parent=107119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/categories?post=107119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/tags?post=107119"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/techxmedia.com\/en\/wp-json\/wp\/v2\/contributor?post=107119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}