In the first half of 2026, Cloudflare intercepted an average of 5,343 network layer DDoS attacks per hour, indicating a trend influenced by geopolitical factors. The latest report highlights that these attacks are no longer limited to opportunistic strikes but are closely related to international conflicts and major sporting cultural events.
Surge in Large-Scale Attacks
According to Cloudflare's data, there were a total of 935 network layer attacks exceeding 1 Tbps in the first half of 2026, with attacks over 1 Tbps in the second quarter surging by 519% compared to the first quarter. This figure demonstrates an escalation in both the scale and frequency of attacks.
Geopolitical Conflicts Affecting Attack Targets
The report indicates that following the military conflict between Israel, the United States, and Iran at the end of February, government sectors became one of the primary targets of cyberattacks. The ranking of these sectors rose from 29th in the first quarter to 9th in the second quarter, illustrating the impact of geopolitical conflicts on cybersecurity.
Major Events Triggering Attack Attention
In the lead-up to the NATO summit in Ankara, Turkey experienced a doubling of attack traffic, making it the third most attacked country globally in the second quarter. The correlation between these attacks and international events as well as war conflicts has become increasingly evident.
Media Industry as a Major Victim
Due to the influence of international events, war conflicts, and World Cup tournaments, the media, production, and publishing industries have been the most severely attacked sectors for two consecutive quarters, accounting for 14.2% of the HTTP DDoS attack traffic intercepted by Cloudflare.
Changes in Attack Methods
The report also notes a significant shift in attack methods, with DNS attacks rising from 25.7% to 40% of network layer attacks. Additionally, the abuse of Active Directory LDAP-over-UDP endpoints through CLDAP Flood attacks surged by 881.9% quarter-over-quarter, becoming the third most common attack method in the second quarter.
Effectiveness of International Law Enforcement Actions
In April, the volume of attack requests reached 64.6 trillion, marking a peak in attacks for the first half of the year. Subsequently, the volume of attacks significantly declined, which may be related to the Operation PowerOFF crackdown launched by multiple countries.
For more details, please refer to the full report (English version). For further insights into the findings mentioned above, members of Cloudflare's threat intelligence team can be arranged for interviews.
TechRitual 企業科技編輯部（香港）。biz.techritual.com 的外語版本由繁體中文原文翻譯。
