2026-yilning uchinchi choragida Cloudflare tarmoq qatlamidagi 18,2 million taqsimlangan xizmatdan bosh tortish (DDoS) hujumlarini muvaffaqiyatli yumshatdi. Bu o'sish hujumchilarning endi katta trafik to'fonlari o'rniga qisqa, tez-tez uzilishlarni afzal ko'rish tendentsiyasini ko'rsatadi. 2025-yilning shu choragi bilan solishtirganda, bu Cloudflare tarmog'i bo'ylab hujumlar sonining 208% ga sezilarli o'sishini anglatadi.
29-oktabrda e'lon qilingan Cloudflare Q3 2026 DDoS tahdidlar hisobotida iyuldan sentyabrgacha bo'lgan davr qamrab olingan. Kompaniyaning tahdid razvedkasi tashkiloti Cloudforce One soatiga taxminan 8 226 ta tarmoq qatlamidagi hujumni, shuningdek 14,4 trillion zararli HTTP so'rovini qayd etdi. Bu o'lchovlar alohida toifalarni ifodalaydi, individual hujumlarning umumiy soni emas.
Yumshatilgan trafik tarmoq qatlamida 272,6 petabayt va HTTP qatlamida 95,1 petabaytga yetdi, bu choraklik umumiy ko'rsatkichlar ortidagi barqaror infratuzilma yukini ta'kidlaydi.
Asosiy tendentsiya tezlik edi: tarmoq qatlamidagi hujumlarning 96% i o'n daqiqa ichida tugadi, 98% i esa 1 Gbps dan past qoldi. Nisbatan kichik bo'lsa-da, bu to'fonlar yetarli himoyasiz ochiq serverlar va veb-saytlarni bosib olishi mumkin.
DDoS hujumlari (Manba: Cloudflare)
Cloudflare bu naqshni DDoS-ijara "booter" xizmatlariga mos deb ta'rifladi. Kompyuter dasturiy ta'minot kompaniyalari, qimor va kazino bizneslari hamda axborot texnologiyalari tashkilotlari bu yuqori sonli kampaniyalarning asosiy nishonlari bo'ldi.
Shu bilan birga, 1 Tbps dan oshgan hujumlar Q2 dagi 805 tadan Q3 da 251 taga tushdi, bu deyarli 69% pasayishdir. Cloudflare bu pasayish 2026-yil boshida Aisuru, KimWolf, JackSkid va Mossadning huquqni muhofaza qiluvchi organlar tomonidan buzilishi bilan bir vaqtda sodir bo'lganini ta'kidladi, lekin aniq sababiy bog'liqlikni o'rnatmadi.
Mirai botnetlarining DDoS va proksi platformalariga kengroq evolyutsiyasi alohida operatsiyalarni buzish asosiy ekotizimni yo'q qilmasligini ko'rsatadi. Cloudflare Dysphoria va Evooo1Bot kabi yangi variantlarni kuzatishda davom etdi.
Evooo1Botning routerlarni buzish qobiliyatlari bilan bog'liq tahlil Mirai-dan olingan to'fon, proksi uzatish, ma'lumot o'g'irlash va ekspluatatsiya orqali tarqalish kombinatsiyasini hujjatlashtirdi.
Ulanishsiz yengil katalog kirish protokoli (CLDAP) hujumlari chorakdan chorakka 99,5% ga qulab tushdi va tarmoq qatlamidagi hujumlarning atigi 0,05% ini tashkil etdi. Bu vektor UDP 389-porti orqali ochiq domen nazoratchilarini suiiste'mol qiladi va soxta manba manzillari orqali jabrlanuvchilarga kuchaytirilgan javoblarni aks ettiradi.
Eng ko'p hujum qilingan joy (Manba: Cloudflare)
DNS kuchaytirish teskari yo'nalishda harakatlanib, 215% ga oshdi va hujumlarning 3,43% iga yetdi. Hujumchilar kichik so'rovlar yuborib, jabrlanuvchiga yo'naltirilgan kattaroq javoblarni keltirib chiqaradigan ochiq DNS rezolverlarini suiiste'mol qiladi. Boshqa UDP to'fonlari tarmoq qatlamidagi hujumlarning 14,06% idan 31,31% igacha ko'tarildi, bu ulanishsiz trafikni suiiste'mol qilishga kengroq siljishni ko'rsatadi.
AQSh eng ko'p hujum qilingan joy sifatida qayd etildi, undan keyin Xitoy va Indoneziya. Kanada o'n pog'ona yuqorilab oltinchi o'ringa, Isroil esa yetti o'rin yuqorilab o'ninchi o'ringa ko'tarildi. OAV, Ishlab chiqarish va Nashr eng ko'p hujum qilingan soha bo'lib qoldi, garchi nishonlash diversifikatsiyalashgani sari uning ulushi sezilarli darajada pasaydi.
Himoyachilar uchun operatsion qiyinchilik javob tezligidir. Ko'pchilik hujumlar daqiqalar ichida tugashi bilan, Cloudflare qo'lda aralashuvni kutish o'rniga avtonom aniqlash va yumshatishni ta'kidladi. Uning bepul botnet tahdidlar oqimi endi dunyo bo'ylab 800 dan ortiq tarmoqni xizmat qiladi.
SOCingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering. 16K SOCdan tahdid razvedkasini integratsiya qiling.
In the third quarter of 2026, Cloudflare successfully mitigated 18.2 million network-layer distributed denial-of-service (DDoS) attacks. This increase indicates a trend among attackers who now favor short, frequent disruptions over large traffic floods. Compared to the same quarter in 2025, this represents a significant 208% rise in the frequency of attacks across Cloudflare’s network.
Published October 29, the Cloudflare Q3 2026 DDoS Threat Report covers July through September. Cloudforce One, the company’s threat intelligence organization, recorded about 8,226 network-layer attacks per hour, along with 14.4 trillion malicious HTTP requests. These measurements represent separate categories, rather than a combined count of individual attacks.
Mitigated traffic reached 272.6 petabytes at the network layer and 95.1 petabytes at the HTTP layer, underscoring the sustained infrastructure burden behind the quarterly totals.
The defining trend was frequency: 96% of network-layer attacks ended within ten minutes, while 98% remained below 1 Gbps. Although comparatively small, these floods can still overwhelm exposed servers and websites without sufficient protection.
DDoS Attacks (Source: Cloudflare)
Cloudflare described the pattern as consistent with DDoS-for-hire “booter” services. Computer software companies, gambling and casino businesses, and information technology organizations were prominent targets of these high-count campaigns.
Meanwhile, attacks exceeding 1 Tbps fell from 805 in Q2 to 251 in Q3, a nearly 69% decline. Cloudflare noted that this reduction coincided with law enforcement disruption of Aisuru, KimWolf, JackSkid, and Mossad earlier in 2026, without establishing a definitive causal relationship.
The broader evolution of Mirai botnets into DDoS and proxy platforms shows why disrupting individual operations doesn’t eliminate the underlying ecosystem. Cloudflare continued observing emerging variants, including Dysphoria and Evooo1Bot.
Related analysis of Evooo1Bot’s router-compromising capabilities documented a combination of Mirai-derived flooding, proxy relaying, credential theft, and exploit-driven propagation.
Connectionless Lightweight Directory Access Protocol, or CLDAP, attacks collapsed 99.5% quarter over quarter, accounting for just 0.05% of network-layer attacks. This vector abuses exposed domain controllers over UDP port 389, reflecting amplified responses toward victims through spoofed source addresses.
most attacked location (Source: CLoudflare)
DNS amplification moved in the opposite direction, increasing 215% and reaching 3.43% of attacks. Attackers exploit open DNS resolvers by submitting small queries that trigger larger responses directed at the victim. Other UDP floods rose from 14.06% to 31.31% of network-layer attacks, showing a broader shift toward abusing connectionless traffic.
The United States ranked as the most-attacked location, followed by China and Indonesia. Canada climbed ten positions to sixth, while Israel rose seven places to tenth. Media, Production & Publishing remained the most-attacked industry, although its share fell substantially as targeting diversified.
For defenders, the operational challenge is response speed. With most attacks ending within minutes, Cloudflare emphasized autonomous detection and mitigation rather than waiting for manual intervention. Its free botnet threat feed now serves more than 800 networks worldwide.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.
