Cloudflare mitigated more than 5,300 network-layer attacks every hour in the first half of 2026 as attackers increasingly targeted governments, media organizations, and major public events
Distributed Denial-of-Service (DDoS) attacks are becoming larger, more frequent, and increasingly influenced by geopolitical events, according to Cloudflare’s latest DDoS Threat Report H1 2026. The findings suggest that cybercriminals and threat actors are no longer targeting organizations solely for financial gain. Instead, attacks are increasingly being used as tools of disruption during periods of political tension, military conflict, and globally visible events.
Drawing on data from one of the world’s largest Internet networks, Cloudflare’s report paints a picture of a rapidly evolving threat landscape where organizations face unprecedented risks to the availability and reliability of their digital services. During the first six months of 2026 alone, Cloudflare mitigated an average of 5,343 network-layer DDoS attacks every hour, highlighting the scale at which attackers are operating.
The report suggests that DDoS attacks have become a preferred method for disrupting online services because they can be launched quickly, scaled aggressively, and used to target public-facing infrastructure without requiring direct compromise of systems. As organizations continue to accelerate digital transformation initiatives, service availability is becoming just as important as traditional cybersecurity measures such as data protection and breach prevention.
Hyper-Volumetric Attacks Reach New Levels
One of the most significant findings from the report is the dramatic rise in extremely large DDoS attacks.
Cloudflare reported mitigating 935 network-layer attacks exceeding one terabit per second (Tbps) during the first half of 2026. These hyper-volumetric attacks increased by 519% between the first and second quarters of the year, underscoring how attackers are gaining access to increasingly powerful botnets and attack infrastructure.
The growth of these attacks reflects a broader trend in cybercrime. Attackers are leveraging larger numbers of compromised devices, cloud resources, and amplification techniques to overwhelm targets with unprecedented traffic volumes. For many organizations, even a short-lived disruption can result in operational downtime, reputational damage, customer dissatisfaction, and financial losses.
The emergence of attacks exceeding one terabit per second also highlights how traditional on-premises defense mechanisms are becoming increasingly difficult to scale against modern threat levels. Organizations are therefore turning to cloud-based mitigation platforms capable of absorbing and filtering massive volumes of malicious traffic before it reaches business-critical systems.
“The latest DDoS data shows that organisations in the Middle East and Africa cannot view availability as a purely technical concern. The surge in hyper-volumetric attacks and the growing use of DNS-based vectors reinforce the need for always-on, intelligent protection that can detect and mitigate attacks before critical services are affected,” said Ercan Aydin, AVP, Middle East, Türkiye & Africa, Cloudflare.
Geopolitical Events Are Reshaping Target Selection
Perhaps the most important trend identified in the report is the growing relationship between geopolitical developments and cyberattacks.
Cloudflare observed significant increases in attacks targeting government institutions following military developments involving Israel, Iran, and the United States during the first quarter of the year. As a result, the Government sector jumped from the 29th most-targeted industry in Q1 to the ninth most-targeted industry in Q2, representing the largest industry ranking movement observed during the reporting period.
This shift reflects a broader global pattern where cyber activities increasingly mirror geopolitical developments. DDoS attacks are being used to disrupt services, influence public narratives, generate visibility for ideological causes, or demonstrate technical capabilities during periods of political tension.
Unlike traditional cyberattacks that focus on data theft or financial gain, politically motivated DDoS campaigns are often designed to maximize disruption and public attention. Government agencies, public institutions, and critical infrastructure providers therefore face growing pressure to prepare for availability-focused attacks that may coincide with wider geopolitical events.
Major Events Continue to Attract Cyberattacks
The report also found a strong correlation between high-profile international events and increased cyber activity.
Turkey emerged as the third most-attacked country globally during the second quarter of 2026, with attack traffic more than doubling during security preparations surrounding the Ankara NATO Summit.
This finding reinforces a long-standing trend in cybersecurity: major political, diplomatic, sporting, and cultural events create attractive opportunities for attackers seeking visibility, disruption, or influence.
Organizations associated with large public events often experience heightened exposure due to increased media attention, larger online audiences, and greater dependence on digital communication platforms. Attackers frequently take advantage of these circumstances to maximize the impact of their campaigns.
For security teams, this means cyber preparedness can no longer be based solely on internal business calendars. Monitoring geopolitical developments and major regional events is becoming an important component of threat management and business continuity planning.
Media Organizations Remain Prime Targets
Among all industries analyzed in the report, Media, Production, and Publishing emerged as the most targeted sector throughout the first half of 2026.
The industry accounted for 14.2% of all mitigated HTTP DDoS traffic, making it the most attacked sector in both the first and second quarters.
The continued targeting of media organizations reflects their critical role during periods of international conflict, elections, major sporting tournaments, and global news events. News organizations often become targets because disrupting their services can interfere with information dissemination and public communication.
With global events, geopolitical conflicts, and major tournaments such as the FIFA World Cup generating substantial media attention, attackers appear increasingly focused on organizations that shape public narratives and provide real-time information to audiences worldwide.
DNS-Based Attacks Surge as Tactics Evolve
While attack volumes continue to grow, attackers are also changing the techniques they use.
The report highlights a significant increase in DNS-based attacks, which rose from 25.7% of all network-layer attacks in Q1 to 40% in Q2.
Domain Name System (DNS) infrastructure serves as one of the foundational components of the Internet, translating domain names into IP addresses. By targeting DNS services, attackers can disrupt an organization’s ability to remain accessible online even if websites and applications remain operational.
Cloudflare also reported an 881.9% increase in CLDAP Flood attacks, making it the third most common attack vector in the second quarter. CLDAP floods abuse Lightweight Directory Access Protocol services running over UDP to amplify attack traffic and overwhelm target systems.
The rapid growth of these attack methods demonstrates how threat actors are continuously adapting their strategies to exploit different components of network infrastructure.
Rather than relying exclusively on traditional volumetric attacks, modern adversaries are combining multiple techniques to increase effectiveness and challenge defensive measures.
Law Enforcement Operations May Be Having an Impact
Interestingly, the report suggests that coordinated law enforcement activity may be influencing attack volumes.
April recorded the highest level of DDoS activity during the reporting period, reaching approximately 6.46 trillion requests. However, subsequent months saw a noticeable decline in attack volumes.
Cloudflare notes that this reduction may have been partially influenced by multinational enforcement initiatives such as Operation PowerOFF, an international effort aimed at disrupting DDoS-for-hire services and cybercriminal infrastructure.
These findings highlight the value of international cooperation in combating cybercrime. While law enforcement actions may not eliminate threats entirely, they can disrupt attacker operations, increase costs, and temporarily reduce attack volumes.
Implications for the Middle East and Africa
For organizations across the Middle East and Africa, the report delivers an important message: DDoS protection can no longer be viewed as a niche cybersecurity function.
As governments, financial institutions, media companies, telecommunications providers, and enterprises continue expanding digital services, maintaining availability has become a strategic business requirement.
The region is undergoing rapid digital transformation, with increasing adoption of cloud services, e-government platforms, online banking, digital payments, and AI-driven applications. Any disruption to these services can have significant operational and reputational consequences.
The findings suggest organizations should prepare not only for larger attacks but also for attacks that align with geopolitical developments, public events, and periods of heightened visibility.
The Growing Importance of Digital Resilience
Cloudflare’s H1 2026 report demonstrates that the DDoS threat landscape is entering a new phase. Hyper-volumetric attacks, evolving attack vectors, geopolitical motivations, and event-driven targeting are collectively reshaping how organizations must think about cybersecurity and resilience.
Availability is no longer simply an operational concern. In today’s environment, the ability to remain online during periods of disruption is increasingly becoming a competitive, economic, and even national security requirement.
For security leaders, the challenge will be ensuring that protection strategies evolve as quickly as attacker tactics. Organizations that combine proactive monitoring, always-on mitigation, threat intelligence, and resilient infrastructure will be best positioned to withstand the next generation of DDoS attacks.
