Surge in DDoS Attacks Over 1 Tbps Amidst Botnet Resurgence

In the first half of 2026, Cloudflare reported a significant increase in DDoS attacks, particularly those exceeding 1 Tbps, with 935 such attacks mitigated, marking a 519% rise from Q1. April 2026 saw the peak of DDoS activity, with 6.46 trillion requests and 165 petabytes of traffic. The resurgence of botnets, particularly Aisuru and Kimwolf, has led to a competitive environment for vulnerable devices, with Aisuru now driving approximately 33% of global DDoS traffic. Despite the surge in large-scale attacks, 96.62% of network-layer attacks remained below 500 Mbps, and most attacks were brief, lasting under 10 minutes. The decline in attack volume post-April is attributed to Operation PowerOFF, which targeted DDoS-for-hire services across 21 countries. The geopolitical context includes increased attacks on nations involved in physical-world conflicts, notably Iran and China.

Key Points: • Cloudflare mitigated 935 DDoS attacks exceeding 1 Tbps in H1 2026, a 519% increase from Q1. • April 2026 was the peak month for DDoS activity, with 6.46 trillion requests recorded. • The resurgence of botnets like Aisuru has led to a competitive landscape for vulnerable devices.