Cloudflare Q3 2026 DDoS Threat Report: 18.2 Million Network-Layer Attacks (+38% QoQ) Driven by Dysphoria, Evooo1Bot and Booter Services

Key facts for Cloudflare Q3 2026 DDoS report

Detection coverage for Cloudflare Q3 2026 DDoS report

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4884 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Dysphoria and Evooo1Bot C2 Infrastructure Contact (C2)

Detects firewall, flow or DNS activity to Dysphoria C2 IPs and domains (peer4you.net, trees4sale.net, saintpetersburgresident.ru, androiddebugbridge.su), the Evooo1Bot C2 91.92.40.118 on TCP/443 (encrypted AES-256-CTR/ChaCha20/XOR), and community-reported sibling IPs 45.153.34.231 and 45.156.87.213 (OSINT tier, lower confidence).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1568, T1090, T1573.001
• Data sources: firewall, dns, zeek, microsoft_defender_for_endpoint, splunk:index=firewall, splunk:index=dns, sentinel:CommonSecurityLog, sentinel:DnsEvents, sentinel:DeviceNetworkEvents
• Severity: high
• Confidence: high

Splunk SPL

(index=firewall OR index=network OR index=dns) earliest=-24h (dest_ip IN ("91.92.40.118", "217.60.195.160", "76.164.203.171", "92.42.100.131", "78.153.155.152", "144.31.38.215", "45.153.34.231", "45.156.87.213") OR query IN ("*.peer4you.net", "*.trees4sale.net", "*.saintpetersburgresident.ru", "*.androiddebugbridge.su", "peer4you.net", "trees4sale.net", "saintpetersburgresident.ru", "androiddebugbridge.su"))
| eval remote=coalesce(query, dest_ip)
| eval client=coalesce(src_ip, src)
| eval family=case(remote=="91.92.40.118", "Evooo1Bot C2 and loader host", in(remote, "45.153.34.231", "45.156.87.213"), "community-reported sibling infrastructure (lower confidence)", true(), "Dysphoria C2")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by client, remote, family
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let c2_ips = dynamic(['91.92.40.118', '217.60.195.160', '76.164.203.171', '92.42.100.131', '78.153.155.152', '144.31.38.215', '45.153.34.231', '45.156.87.213']);
let c2_regex = @'(^|[./])(peer4you[.]net|trees4sale[.]net|saintpetersburgresident[.]ru|androiddebugbridge[.]su)([:/]|$)';
union
(CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationIP in (c2_ips) | project TimeGenerated, Source = 'Firewall', Client = SourceIP, Remote = DestinationIP, Port = tostring(DestinationPort)),
(DeviceNetworkEvents | where Timestamp > ago(24h) | where RemoteIP in (c2_ips) or RemoteUrl matches regex c2_regex | project TimeGenerated = Timestamp, Source = 'MDE', Client = DeviceName, Remote = coalesce(RemoteUrl, RemoteIP), Port = tostring(RemotePort)),
(DnsEvents | where TimeGenerated > ago(24h) | where Name matches regex c2_regex | project TimeGenerated, Source = 'DNS', Client = ClientIP, Remote = Name, Port = '53')
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Client, Remote, Source, Port

Sigma

title: DNS Query for Dysphoria C2 Domains (TL-2026-4884)
id: 1b6e3d84-9c25-4f7a-a0d8-52e7c9b4f136
status: experimental
description: Detects DNS resolution of domains reported as Dysphoria botnet C2 infrastructure (peer4you.net, trees4sale.net, saintpetersburgresident.ru, androiddebugbridge.su)
references:
    - https://blog.xlab.qianxin.com/botnet-rising-star-the-evolution-and-in-depth-technical-analysis-of-dysphoria/
    - https://www.shadowserver.org/hp-rewrite/a35e45389ec1585eac021dd186906ef9
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
    - attack.command-and-control
    - attack.t1568
    - attack.t1090
    - attack.t1573.001
logsource:
    category: dns_query
detection:
    selection:
        QueryName|endswith:
            - '.peer4you.net'
            - '.trees4sale.net'
            - '.saintpetersburgresident.ru'
            - '.androiddebugbridge.su'
    condition: selection
falsepositives:
    - Threat-intelligence sandboxes or researchers resolving the published domains
level: high

Known false positives:

• Security researchers and sandboxes resolving the published C2 domains
• Sibling IPs 45.153.34.231 and 45.156.87.213 are community-reported only and may be reassigned or shared hosting

Tuning notes: Adjust index names to your firewall and DNS data, or use the Network_Traffic and Network_Resolution data models. Load the IOCs from a lookup so they refresh from the feed. Treat the two community sibling IPs as hunting leads, not blocking criteria, until confirmed. C2 traffic is encrypted on TCP/443, so rely on destination IOCs rather than payload content.

• 🔒 Telnet/SSH Credential Brute Force Fan-out from Single Source (Exploitation) · unlock with TL Creds
• 🔒 Dysphoria libdalvikengine.so Masquerade and Evooo1Bot Sniffer Artifacts (Post-Exploitation) · unlock with TL Creds
• 🔒 Dysphoria Blockchain Name Resolution and Relay Node Requests (C2) · unlock with TL Creds
• 🔒 Web or Runtime Process Spawning Shell Download Chain (Exploitation, React2Shell) · unlock with TL Creds
• 🔒 Evooo1Bot Loader Chain via wget.sh / [indicator] (Post-Exploitation) · unlock with TL Creds
• 🔒 DNS Amplification Reflection Flood Against a Single Host (C2 and Impact) · unlock with TL Creds
• 🔒 IoT Router Exploit Paths and Evooo1Bot Loader Fetch (Exploitation) · unlock with TL Creds
• 🔒 Evooo1Bot Systemd/Cron Persistence Artifacts (Post-Exploitation) · unlock with TL Creds

Indicators of compromise for Cloudflare Q3 2026 DDoS report

As of 2026-10-31, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-4884.

Sample indicators (3 of 27)

• IP address: 91.92.40[.]118
• Domain: i[.]peer4you[.]net
• File hash: f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Community OSINT corroboration for Cloudflare Q3 2026 DDoS report

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Cloudflare Q3 2026 DDoS report works

Cloudflare's Cloudforce One team reported (as covered by The Hacker News on 2026-10-31) that it mitigated 18.2 million network-layer (L3/L4) DDoS attacks in Q3 2026, versus 13.2 million in Q2 and 10.0 million in Q1 2026. That equals roughly 197,400 attacks per day, about 8,226 per hour, or one attack every 0.44 seconds. Cloudflare also mitigated 14.4 trillion HTTP DDoS requests in the quarter.

The attack mix shifted. Short-burst, low-bandwidth attacks (under 10 minutes and under 1 Gbps) rose 208%, a pattern that can slip under volumetric alert thresholds. DNS amplification attacks rose 215% and made up 3.43% of network-layer attacks, while CLDAP floods declined. Hyper-volumetric attacks above 1 Tbps fell 69%, from 805 in Q2 to 251 in Q3. The most targeted industries were media/production/publishing, information technology and services, gambling and casinos, computer software, and telecommunications providers. The most attacked countries were the United States, China, Indonesia, the United Kingdom and Turkiye, with Canada and Israel newly in the top 10. DDoS-for-hire booter/stresser services were responsible for hundreds of thousands of attacks.

Two named botnets are cited. Dysphoria is an IoT botnet. QiAnXin XLab traced it from March 2026 as an evolution of the jackskid and fbot families, with blockchain-based C2 resolution (Ethereum ENS and Solana SNS names whose records hide C2 addresses inside fake IPv6 strings) and a modified RC4 protocol. XLab estimated about 200,000 bots in mid-July 2026, and Shadowserver reported about 296,000 infected devices in August 2026. The operators claim up to 4 Tbps of capacity, market it as a stress-tester, and added a UPnP-based relay/proxy variant in late June 2026. Dysphoria spreads through Telnet/SSH brute force and router/camera/gateway vulnerabilities, including CVE-2017-17215 (Huawei), CVE-2020-8515 (DrayTek), CVE-2025-9528 (Linksys), CVE-2025-28137 and CVE-2025-34152 (Totolink) and CVE-2025-55182 (React2Shell).

Evooo1Bot is a Mirai-derived Linux botnet that FortiGuard Labs identified from IPS telemetry in July 2026 and published on 2026-08-13. It reuses the leaked Mirai DDoS engine (16 flood methods) and adds persistence, an interactive shell, HTTP credential sniffing, an SSH scanner with 150+ credentials and honeypot detection, SOCKS relaying, and an HTTP-based CVE exploit dispatcher. It targets Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link devices, among others. C2 traffic is encrypted (AES-256-CTR, ChaCha20, XOR) over port 443.

Context: on 2026-03-20 the US Department of Justice, with Canadian and German authorities, announced disruption of the AISURU, KimWolf, JackSkid and Mossad botnets, which had compromised more than 3 million IoT devices. AISURU was tied to a 31.4 Tbps attack in November 2025. Cloudflare's Q3 2026 primary report URL was not independently verified, so the Q3 figures rest on The Hacker News coverage. Severity is analyst-assigned, as this is a trend report with no CVSS score.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1497 Virtualization/Sandbox Evasion

Credential Access

T1040 Network Sniffing; T1110.001 Password Guessing

Discovery

T1046 Network Service Discovery

Persistence

T1053.003 Cron; T1543.002 Systemd Service

Execution

T1059.004 Unix Shell

Command and Control

T1090 Proxy; T1568 Dynamic Resolution; T1573.001 Symmetric Cryptography

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1498.001 Direct Network Flood; T1498.002 Reflection Amplification; T1499.002 Service Exhaustion Flood

Resource Development

T1584.005 Botnet

Remediation for Cloudflare Q3 2026 DDoS report

Patches

• Apply vendor fixes for the CVEs exploited by Dysphoria and Evooo1Bot: CVE-2017-17215, CVE-2020-8515, CVE-2018-14558, CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, CVE-2025-10123, CVE-2025-55583 and the others listed in cve_list

Immediate actions

• Enable always-on, automated DDoS mitigation that does not depend on volumetric thresholds, since short-burst (<10 min, <1 Gbps) attacks are up 208%
• Restrict or rate-limit inbound DNS responses and block unsolicited UDP/53 and UDP/389 (CLDAP) traffic from the internet; do not run open DNS resolvers or exposed CLDAP
• Block Evooo1Bot and Dysphoria network IOCs at the perimeter and hunt for the listed hashes, domains and the libdalvikengine.so process name on Linux/IoT estates
• Disable Telnet and remote SSH on IoT devices and change default credentials

Workarounds

• Where patches are unavailable, remove management interfaces from the internet and place affected devices behind a firewall or VPN
• Disable UPnP on edge devices to block Dysphoria's port-mapping relay variant

Longer-term hardening

• Replace end-of-life routers, cameras and gateways that cannot receive patches
• Segment IoT/OT devices from corporate networks and restrict outbound traffic, including SOCKS-like relay traffic and UPnP
• Run DDoS tabletop exercises and pre-arrange upstream/ISP scrubbing for high-risk sectors (media, gaming/gambling, software, telecom)
• Monitor for blockchain name-resolution lookups (ENS/SNS) from embedded devices

Affected and fixed versions

• Multiple — Internet-exposed IoT devices, SOHO routers, IP cameras and gateways (Huawei, DrayTek, Linksys, Totolink, NETGEAR, Tenda, D-Link, Telesquare, Mitsubishi Electric, Alcatel)
  Vulnerable versions: Devices exposed to the CVEs in cve_list or using weak Telnet/SSH credentials
  Fixed in: Vendor-patched firmware where available
• Multiple — Internet-facing services targeted by DDoS: media/publishing, IT services, gambling, software and telecom sectors
  Vulnerable versions: Services without automated L3/L4/L7 DDoS mitigation

Timeline of Cloudflare Q3 2026 DDoS report

• 2025-11-01 AISURU-linked botnet activity peaks at a 31.4 Tbps DDoS attack lasting 35 seconds (November 2025), later cited by law enforcement
• 2026-03-16 US federal authorities obtain a search warrant to seize virtual servers and domains used by KimWolf, Aisuru, JackSkid and Mossad botnets
• 2026-03-20 DOJ, with Canadian and German authorities, announces disruption of the AISURU, KimWolf, JackSkid and Mossad botnets (3M+ devices)
• 2026-03-25 XLab captures the first locked-ioc-26 precursor (jackskid variant) using ENS domain locked-ioc-24
• 2026-06-25 locked-ioc-26 relay/proxy-only variant appears; UPnP port mapping and hybrid C2 chain follow on 2026-06-27/28
• 2026-07-01 FortiGuard IPS telemetry first detects locked-ioc-27 activity (July 2026)
• 2026-07-14 XLab measures about 200,000 locked-ioc-26 bots and a peak of 740,000 daily C2 requests during 2026-07-14 to 2026-07-20
• 2026-08-11 Cloudflare publishes its H1 2026 DDoS Threat Report, noting a surge in hyper-volumetric attacks and DNS floods
• 2026-08-13 Fortinet publishes analysis of locked-ioc-27; Shadowserver distributes its locked-ioc-26 special report (about 296,000 devices) on 2026-08-12/13
• 2026-10-31 The Hacker News reports Cloudflare's Q3 2026 data: 18.2M L3 DDoS attacks (+38% QoQ), 14.4T HTTP DDoS requests, short-burst attacks +208%, DNS amplification +215%

Sources cited for Cloudflare Q3 2026 DDoS report

• Shadowserver: CRITICAL: Dysphoria Botnet Special Report shadowserver.org · Advisory · 2026-08-12
• Botnet Rising Star: The Evolution and In-Depth Technical Analysis of Dysphoria (QiAnXin XLab) blog.xlab.qianxin.com · Research
• Multi-Functional Linux Botnet Evooo1Bot (Fortinet FortiGuard Labs) Fortinet · Vendor report · 2026-08-13
• Cloudflare DDoS Threat Report H1 2026 blog.cloudflare.com · Vendor report · 2026-08-11
• Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% The Hacker News · News · 2026-10-31
• New Dysphoria DDoS botnet spreads to 200K devices worldwide (BleepingComputer) BleepingComputer · News
• Evooo1Bot Linux botnet exploits known vulnerabilities (The Hacker News) The Hacker News · News
• Global law enforcement operation targets AISURU, Kimwolf, JackSkid botnet operators (Security Affairs) securityaffairs.com · News · 2026-03-20

More in threat intel

• Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys
• OWASP Warns AI Agents Are Lowering the Skill Barrier for Cyberattacks (LLM Exploit Generation Guide 2.0)
• Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198
• Hunting Malware C2 Infrastructure with FOFA Queries (AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic, Supershell)
• Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems, Q1 2026

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors