DDoS Landscape Shifts: Surge in ‘Swarm’ Attacks and Tactical Pivot Away from Giant Volumetric Floods
The third quarter of 2026 has marked a significant evolution in the distributed denial-of-service (DDoS) threat landscape, characterized by a move away from massive, hyper-volumetric attacks toward high-frequency, short-duration ‘swarm’ tactics. According to the latest threat intelligence analysis, the shift reflects both the impact of recent law enforcement interventions against major botnet infrastructure and a tactical pivot by threat actors toward more agile, connectionless protocols.
The Rise of the ‘Swarm’
Data from the third quarter indicates a 208% surge in short-burst, low-bandwidth attacks compared to the same period in 2025. These operations, which typically last fewer than 10 minutes and remain under 1 Gbps, are increasingly becoming the operational signature of DDoS-for-hire services. While these individual bursts are smaller than the record-breaking volumetric floods of the past, they are highly effective at disrupting server availability and web services, particularly within the software, information technology, and gambling sectors.
Conversely, the prevalence of hyper-volumetric attacks—those exceeding 1 Tbps—has plummeted by approximately 69% since the second quarter of 2026. This decline is largely attributed to coordinated law enforcement actions earlier in the year that successfully dismantled four major IoT botnets: Aisuru, KimWolf, JackSkid, and Mossad. Despite these successes, the threat from IoT-based botnets remains persistent, as new variants such as Dysphoria and Evooo1Bot continue to emerge and replace their predecessors.
Tactical Shifts in Attack Vectors
Threat actors demonstrated a dramatic change in their use of reflection and amplification techniques this quarter. The most notable development was the near-total abandonment of CLDAP (Connectionless Lightweight Directory Access Protocol) floods, which saw a 99.5% quarter-over-quarter collapse. This represents a significant reversal from the first half of the year, during which CLDAP attacks had surged by over 500%.
In place of CLDAP, attackers have pivoted toward other connectionless protocols, driving a 215% increase in DNS amplification attacks. Furthermore, general UDP floods now account for over 31% of all network-layer attack traffic. By leveraging these protocols, adversaries continue to exploit open resolvers to reflect and amplify traffic, effectively consuming the network and compute resources of their targets without needing to sustain high-bandwidth connections.
Geographic and Industry Trends
The target profile for DDoS campaigns has broadened significantly in both scope and geography. While media and publishing organizations remain frequent targets, their relative share of total attacks has decreased as adversaries expand their focus to include consumer services, internet infrastructure, and adult entertainment. Geographically, the United States reclaimed the top position as the most-attacked location, followed by China and Indonesia.
Notably, Canada and Israel experienced significant spikes in targeted activity throughout the quarter. Canada rose to the sixth most-attacked location, facing increased pressure on its retail and telecommunications infrastructure, while Israel saw a surge in activity linked to geopolitical tensions and domestic events. As these threats continue to evolve, the necessity for autonomous, network-layer mitigation systems becomes increasingly critical, as the majority of modern attacks are concluded before human intervention is possible.
