DDoS attacks shift toward hypervolumetric intensity in H1 2026

Reports from Cloudflare and Link11 regarding the first half of 2026 indicate a significant shift in the DDoS landscape, characterized by a move from high-frequency attacks to more intense, hypervolumetric strikes.

Cloudflare observed a 519 percent increase in attacks exceeding 1 Tbps during the second quarter of 2026. While the majority of attacks remain small and short-lived, there has been a sharp rise in targeting the government sector, which jumped from 29th to 9th in frequency. Media and publishing houses were identified as the most targeted industry, accounting for 14.25 percent of all mitigated HTTP requests. Notably, Brazil has overtaken the United States as the primary country of origin for these attacks, while Turkey has become the third most frequent target.

Link11's data corroborates this trend of increased intensity despite a 42 percent decrease in the total number of attacks within its network. Record-breaking bandwidth attacks reached 2.3 Tbit/s, an 85 percent increase over the previous year. This escalation is attributed to the use of superbotnets like Aisuru and Kimwolf, as well as hijacked cloud servers. The decline in total attack volume is linked to international law enforcement actions, including Europol and Eurojust's 'Operation Eastwood' and coordinated efforts by authorities in the US, Canada, and Germany to dismantle large IoT botnets.