Cloudflare detected 8.3 million DDoS attacks in the last quarter, reflecting a 40% year-over-year (YoY) increase in threats to networks.

Cloudflare’s Quarterly DDoS Threat Report saw a 15% increase quarter-over-quarter (QoQ) in Q3 2025, equivalent to nearly 3,780 attacks per hour, and corresponding to 170% of the DDoS attacks mitigated by Cloudflare throughout last year.

The results saw the web giant declare DDoS attacks are now a commonplace threat to the internet, with the start of an era where DDoS attacks have reached new scales in sophistication and size, outgrowing on-premise mitigation appliances or on-demand scrubbing center solutions. A security report from Nokia similarly reported a “new wave of ‘terabit tsunami’ attacks” is testing the limits of traditional defenses in telecoms, requiring operators to potentially start adopting AI-driven DDoS defenses.

The biggest culprit identified by Cloudflare behind the recent DDoS ‘tsunami’ is Aisuru, a Turbo Mirai-class botnet that targets Internet of Things (IoT) flaws, mainly in the form of home routers and cameras.

Described as the apex of botnets by Cloudflare, Aisuru was behind what Microsoft recently dubbed the largest DDoS attack ever observed in the cloud, with the tech giant thwarting an exploit measured at 15.72 Tb/s and 3.64 billion packets per second (pps).

“Aisuru unleashed hyper-volumetric DDoS attacks routinely exceeding 1 terabit per second and 1 billion packets per second (Bpps). The number of these attacks surged 54% quarter-over-quarter (QoQ), averaging 14 hyper-volumetric attacks daily. The scale was unprecedented, with attacks peaking at 29.7 Tb/s and 14.1 Bpps,” Cloudflare’s researchers wrote.

“Since the start of 2025, Cloudflare has already mitigated 2,867 Aisuru attacks. In the third quarter alone, Cloudflare mitigated 1,304 hyper-volumetric attacks launched by Aisuru. That represents an increase of 54% QoQ.”

The botnet was used to target sectors such as telecommunication providers and hosting providers, with its potency increased by distributors offering “chunks” of Aisuru as botnets-for-hire.

Lasting 69 seconds, the peak 29.7 Tb/s Aisuru attack detected and stopped by Cloudflare was a user datagram protocol (UDP) carpet-bombing attack “bombarding an average of 15K destination ports per second”, randomizing various packet attributes in an effort to evade defenses.

Such UDP DDoS attacks saw a 231% increase QoQ to become the top attack vector at the network-layer, while DNS floods were ranked second in Cloudflare’s research.

In third place were SYN floods, which represent the Synchronize aspect of the TCP handshake, followed by ICMP (Internet Control Message Protocol) floods in fourth, which constituted just over half of all network-layer DDoS attacks.

“Almost 2 out of every 100 network-layer DDoS attacks are launched by permutations of the Mirai botnet,” Cloudflare added. “Around 20% of HTTP DDoS attacks [meanwhile] originated from fake or headless browsers, or included suspicious HTTP attributes. The remaining ~10% were a combination of generic floods, unusual requests, cache-busting attacks, and attacks that targeted login endpoints.”

Seven out of the top ten attack sources are in Asia, primarily Indonesia, a regular name in Cloudflare’s naughty list.

The mining, minerals, and metals industry, as well as the automotive industry, were the most targeted industries in 2025 Q3, with China remaining the most attacked nation. Cloudflare noted DDoS attacks against the mining, minerals, and metals sector significantly increased as the 25th European Union–China trade summit increased tensions last quarter over electric vehicle tariffs and rare-earth exports. Other geopolitical events, such as protests, often coincided with DDoS exploits, it was reported.

Cybersecurity companies also saw a significant increase in DDoS attacks, while HTTP DDoS attack traffic against generative AI companies rose by 347% in Q3.

After China, Turkey, and Germany make up the top three of DDoS-vulnerable nations, while the U.S. rose by 11 spots to become the fifth most attacked country in Cloudflare's ranking.