Cloudflare’s recent Q3 2026 DDoS Threat Report reveals a staggering 208% year-on-year increase in network-layer distributed denial-of-service (DDoS) attacks, with Israel now ranking among the world’s ten most-attacked locations. This surge underscores a significant shift towards smaller, faster, and more frequent attacks, raising concerns for organizations across the Middle East and Africa as they expand their digital services.
During the third quarter of 2026, Cloudflare mitigated 18.2 million network-layer attacks, averaging 8,226 attacks per hour. Notably, 95.75% of these attacks lasted less than ten minutes, and 98% remained below 1 Gbps, characteristics typical of DDoS-for-hire services that allow attackers to disrupt services with minimal technical expertise.
Israel’s Rising Threat Landscape
The report highlights a notable geographical shift in DDoS attacks, with Israel climbing seven positions to become the world’s tenth most-attacked location. This increase coincided with significant domestic political events and the Rosh Hashanah holiday, alongside a broader pattern of hostile cyber activity targeting the nation. In contrast, the United States reclaimed its position as the most-attacked country, while Canada and Indonesia also saw significant increases in attack frequency.
Decline in Hyper-Volumetric Attacks
Despite the overall rise in attacks, Cloudflare observed a 69% decline in hyper-volumetric incidents, with attacks exceeding 1 Tbps dropping from 805 in Q2 to 251 in Q3. This reduction aligns with law enforcement actions against major IoT botnets earlier in the year. However, the emergence of new botnet variants, such as Dysphoria and Evooo1Bot, continues to pose a significant threat, particularly as Mirai-classified attacks remain prevalent.
Adapting Attack Techniques
Cloudflare’s findings also indicate a shift in attack methodologies. While CLDAP-based attacks saw a dramatic 99.5% decline, DNS amplification attacks surged by 215%. Other UDP flood attacks also increased, demonstrating how quickly attackers can adapt their strategies, complicating the security landscape for organizations reliant on reactive measures.
Ercan Aydin, Area Vice President for the Middle East, Turkey, and Africa at Cloudflare, emphasized the need for organizations to rethink their DDoS protection strategies. “The challenge is no longer limited to defending against occasional, exceptionally large attacks,” he stated. “We are seeing an increasingly persistent stream of smaller, faster, and more distributed attacks, often designed to overwhelm infrastructure before security teams have time to respond.”
As digital services become integral to economic growth and national transformation initiatives across the Middle East, the report highlights the critical need for automated, network-wide security solutions. Cloudflare’s global network, which spans over 330 cities and offers 500 Tbps of capacity, is designed to absorb and mitigate DDoS attacks automatically, providing essential protection for organizations in the region.
For further insights, the full report can be accessed through Intelligent CISO.
