The first half of 2026 has seen a significant escalation in Distributed Denial-of-Service (DDoS) attacks, with threat actors increasingly deploying hyper-volumetric attacks capable of generating unprecedented levels of malicious traffic.
According to the latest research from network security provider Cloudflare, DDoS activity has surged sharply, while attacks exceeding 1 terabit per second (Tbps) are becoming an increasingly serious threat to organizations and internet infrastructure.
Cloudflare’s DDoS Threat Report highlights a notable evolution in attack techniques. While traditional botnet-driven traffic floods continue to pose a major challenge, attackers are increasingly turning to reflection and amplification techniques to multiply the volume of traffic generated against their targets. These methods allow relatively modest resources to produce enormous amounts of attack traffic, putting additional pressure on network defenses.
Between January and June 2026, Cloudflare reported mitigating approximately 23.2 million network-layer DDoS attacks, alongside a comparable volume of HTTP/HTTPS DDoS activity. The scale of this activity translates into thousands of attacks every hour, demonstrating how DDoS has evolved from an occasional disruption technique into a persistent and industrialized component of the modern cyber threat landscape.
Hyper-Volumetric Attacks raise the Bar
One of the most concerning developments is the growth of hyper-volumetric DDoS attacks. These attacks are generally characterized by traffic volumes exceeding 1 Tbps or attack rates reaching 1 billion packets per second (Bpps).
Cloudflare’s telemetry indicates that the second quarter of 2026 witnessed a substantial increase in these extreme attacks, with activity reportedly rising approximately sixfold compared with the previous quarter. Such growth demonstrates that attackers are gaining access to increasingly powerful botnets and amplification mechanisms.
The potential consequences are significant. Cloudforce One, Cloudflare’s threat intelligence and research organization, notes that even a 100 Mbps attack can disrupt an inadequately protected server. At the 100 Gbps level, malicious traffic can overwhelm the normal operations of a data center, while attacks exceeding 1 Tbps have the potential to impact major portions of internet infrastructure and cause widespread disruption to businesses and online services.
A growing Cyber Threat menace for Businesses
The emergence of larger and more sophisticated DDoS campaigns also highlights the need for organizations to rethink their network security and DDoS mitigation strategies. Conventional perimeter defenses may struggle to cope when attack traffic reaches volumes capable of saturating network links before it even reaches the target infrastructure.
Cloudflare researchers expect the threat landscape to remain challenging, with 1 Tbps-plus DDoS attacks likely to continue appearing in the coming weeks and months. Geopolitical tensions may further contribute to the trend, as cybercriminal groups and politically motivated threat actors increasingly use disruption campaigns as a tool for influence and retaliation.
For enterprises, the message is clear: DDoS protection can no longer be treated simply as an availability issue. As hyper-volumetric attacks continue to grow in scale, organizations need real-time traffic monitoring, resilient infrastructure, automated mitigation, distributed network capacity, and dedicated threat intelligence to maintain business continuity.
The rise of multi-terabit attacks signals a new phase in the DDoS threat landscape—one in which the ability to absorb and rapidly mitigate enormous volumes of malicious traffic could become a critical component of enterprise cybersecurity.
Join our LinkedIn group Information Security Community!
