# Cloudflare Q3 2026 DDoS Threat Report: 18.2 Million Network-Layer Attacks (+38% QoQ) Driven by Dysphoria, Evooo1Bot and Booter Services

> Cloudflare reported 18.2 million network-layer DDoS attacks in Q3 2026 (up 38% from 13.2 million in Q2) plus 14.4 trillion HTTP DDoS requests, with short-burst attacks up 208% and DNS amplification up 215% while >1 Tbps attacks fell 69%. IoT/Linux botnets such as Dysphoria and Evooo1Bot and DDoS-for-hire booter/stresser services are the named drivers.

- **Published:** 2026-10-31T06:21:55Z
- **Last reviewed:** 2026-10-31T06:21:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4884
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4884.png
- **ID:** TL-2026-4884
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)
- **CVEs:** CVE-2017-17215, CVE-2020-8515, CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182, CVE-2013-3307, CVE-2016-20016, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2022-35733, CVE-2007-3010, CVE-2016-6277, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, CVE-2025-10123, CVE-2025-55583

## Description

Cloudflare's Cloudforce One team reported (as covered by The Hacker News on 2026-10-31) that it mitigated 18.2 million network-layer (L3/L4) DDoS attacks in Q3 2026, versus 13.2 million in Q2 and 10.0 million in Q1 2026. That equals roughly 197,400 attacks per day, about 8,226 per hour, or one attack every 0.44 seconds. Cloudflare also mitigated 14.4 trillion HTTP DDoS requests in the quarter.

The attack mix shifted. Short-burst, low-bandwidth attacks (under 10 minutes and under 1 Gbps) rose 208%, a pattern that can slip under volumetric alert thresholds. DNS amplification attacks rose 215% and made up 3.43% of network-layer attacks, while CLDAP floods declined. Hyper-volumetric attacks above 1 Tbps fell 69%, from 805 in Q2 to 251 in Q3. The most targeted industries were media/production/publishing, information technology and services, gambling and casinos, computer software, and telecommunications providers. The most attacked countries were the United States, China, Indonesia, the United Kingdom and Turkiye, with Canada and Israel newly in the top 10. DDoS-for-hire booter/stresser services were responsible for hundreds of thousands of attacks.

Two named botnets are cited. Dysphoria is an IoT botnet. QiAnXin XLab traced it from March 2026 as an evolution of the jackskid and fbot families, with blockchain-based C2 resolution (Ethereum ENS and Solana SNS names whose records hide C2 addresses inside fake IPv6 strings) and a modified RC4 protocol. XLab estimated about 200,000 bots in mid-July 2026, and Shadowserver reported about 296,000 infected devices in August 2026. The operators claim up to 4 Tbps of capacity, market it as a stress-tester, and added a UPnP-based relay/proxy variant in late June 2026. Dysphoria spreads through Telnet/SSH brute force and router/camera/gateway vulnerabilities, including CVE-2017-17215 (Huawei), CVE-2020-8515 (DrayTek), CVE-2025-9528 (Linksys), CVE-2025-28137 and CVE-2025-34152 (Totolink) and CVE-2025-55182 (React2Shell).

Evooo1Bot is a Mirai-derived Linux botnet that FortiGuard Labs identified from IPS telemetry in July 2026 and published on 2026-08-13. It reuses the leaked Mirai DDoS engine (16 flood methods) and adds persistence, an interactive shell, HTTP credential sniffing, an SSH scanner with 150+ credentials and honeypot detection, SOCKS relaying, and an HTTP-based CVE exploit dispatcher. It targets Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link devices, among others. C2 traffic is encrypted (AES-256-CTR, ChaCha20, XOR) over port 443.

Context: on 2026-03-20 the US Department of Justice, with Canadian and German authorities, announced disruption of the AISURU, KimWolf, JackSkid and Mossad botnets, which had compromised more than 3 million IoT devices. AISURU was tied to a 31.4 Tbps attack in November 2025. Cloudflare's Q3 2026 primary report URL was not independently verified, so the Q3 figures rest on The Hacker News coverage. Severity is analyst-assigned, as this is a trend report with no CVSS score.

## MITRE ATT&CK

- T1498.001 Direct Network Flood
- T1498.002 Reflection Amplification
- T1499.002 Service Exhaustion Flood
- T1584.005 Botnet
- T1190 Exploit Public-Facing Application
- T1110.001 Password Guessing
- T1568 Dynamic Resolution
- T1090 Proxy
- T1573.001 Symmetric Cryptography
- T1543.002 Systemd Service
- T1053.003 Cron
- T1036.005 Match Legitimate Resource Name or Location
- T1497 Virtualization/Sandbox Evasion
- T1059.004 Unix Shell
- T1040 Network Sniffing
- T1046 Network Service Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Dysphoria and Evooo1Bot C2 Infrastructure Contact (C2)** (`TL-2026-4884-SPL-003`)

Detects firewall, flow or DNS activity to Dysphoria C2 IPs and domains (peer4you.net, trees4sale.net, saintpetersburgresident.ru, androiddebugbridge.su), the Evooo1Bot C2 91.92.40.118 on TCP/443 (encrypted AES-256-CTR/ChaCha20/XOR), and community-reported sibling IPs 45.153.34.231 and 45.156.87.213 (OSINT tier, lower confidence).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1568, T1090, T1573.001
- **Data sources:** firewall, dns, zeek, microsoft_defender_for_endpoint, splunk:index=firewall, splunk:index=dns, sentinel:CommonSecurityLog, sentinel:DnsEvents, sentinel:DeviceNetworkEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
(index=firewall OR index=network OR index=dns) earliest=-24h (dest_ip IN ("91.92.40.118", "217.60.195.160", "76.164.203.171", "92.42.100.131", "78.153.155.152", "144.31.38.215", "45.153.34.231", "45.156.87.213") OR query IN ("*.peer4you.net", "*.trees4sale.net", "*.saintpetersburgresident.ru", "*.androiddebugbridge.su", "peer4you.net", "trees4sale.net", "saintpetersburgresident.ru", "androiddebugbridge.su"))
| eval remote=coalesce(query, dest_ip)
| eval client=coalesce(src_ip, src)
| eval family=case(remote=="91.92.40.118", "Evooo1Bot C2 and loader host", in(remote, "45.153.34.231", "45.156.87.213"), "community-reported sibling infrastructure (lower confidence)", true(), "Dysphoria C2")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_port) as ports by client, remote, family
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let c2_ips = dynamic(['91.92.40.118', '217.60.195.160', '76.164.203.171', '92.42.100.131', '78.153.155.152', '144.31.38.215', '45.153.34.231', '45.156.87.213']);
let c2_regex = @'(^|[./])(peer4you[.]net|trees4sale[.]net|saintpetersburgresident[.]ru|androiddebugbridge[.]su)([:/]|$)';
union
(CommonSecurityLog | where TimeGenerated > ago(24h) | where DestinationIP in (c2_ips) | project TimeGenerated, Source = 'Firewall', Client = SourceIP, Remote = DestinationIP, Port = tostring(DestinationPort)),
(DeviceNetworkEvents | where Timestamp > ago(24h) | where RemoteIP in (c2_ips) or RemoteUrl matches regex c2_regex | project TimeGenerated = Timestamp, Source = 'MDE', Client = DeviceName, Remote = coalesce(RemoteUrl, RemoteIP), Port = tostring(RemotePort)),
(DnsEvents | where TimeGenerated > ago(24h) | where Name matches regex c2_regex | project TimeGenerated, Source = 'DNS', Client = ClientIP, Remote = Name, Port = '53')
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Client, Remote, Source, Port
```

### Sigma

```yaml
title: DNS Query for Dysphoria C2 Domains (TL-2026-4884)
id: 1b6e3d84-9c25-4f7a-a0d8-52e7c9b4f136
status: experimental
description: Detects DNS resolution of domains reported as Dysphoria botnet C2 infrastructure (peer4you.net, trees4sale.net, saintpetersburgresident.ru, androiddebugbridge.su)
references:
    - https://blog.xlab.qianxin.com/botnet-rising-star-the-evolution-and-in-depth-technical-analysis-of-dysphoria/
    - https://www.shadowserver.org/hp-rewrite/a35e45389ec1585eac021dd186906ef9
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/31
tags:
    - attack.command-and-control
    - attack.t1568
    - attack.t1090
    - attack.t1573.001
logsource:
    category: dns_query
detection:
    selection:
        QueryName|endswith:
            - '.peer4you.net'
            - '.trees4sale.net'
            - '.saintpetersburgresident.ru'
            - '.androiddebugbridge.su'
    condition: selection
falsepositives:
    - Threat-intelligence sandboxes or researchers resolving the published domains
level: high
```

**Known false positives:**

- Security researchers and sandboxes resolving the published C2 domains
- Sibling IPs 45.153.34.231 and 45.156.87.213 are community-reported only and may be reassigned or shared hosting

**Tuning notes:** Adjust index names to your firewall and DNS data, or use the Network_Traffic and Network_Resolution data models. Load the IOCs from a lookup so they refresh from the feed. Treat the two community sibling IPs as hunting leads, not blocking criteria, until confirmed. C2 traffic is encrypted on TCP/443, so rely on destination IOCs rather than payload content.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Telnet/SSH Credential Brute Force Fan-out from Single Source (Exploitation) (locked: unlock with TL Creds)
- Dysphoria libdalvikengine.so Masquerade and Evooo1Bot Sniffer Artifacts (Post-Exploitation) (locked: unlock with TL Creds)
- Dysphoria Blockchain Name Resolution and Relay Node Requests (C2) (locked: unlock with TL Creds)
- Web or Runtime Process Spawning Shell Download Chain (Exploitation, React2Shell) (locked: unlock with TL Creds)
- Evooo1Bot Loader Chain via wget.sh / [indicator] (Post-Exploitation) (locked: unlock with TL Creds)
- DNS Amplification Reflection Flood Against a Single Host (C2 and Impact) (locked: unlock with TL Creds)
- IoT Router Exploit Paths and Evooo1Bot Loader Fetch (Exploitation) (locked: unlock with TL Creds)
- Evooo1Bot Systemd/Cron Persistence Artifacts (Post-Exploitation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `91.92.40[.]118`
- Domain: `i[.]peer4you[.]net`
- File hash: `f13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%](https://thehackernews.com/2026/10/cloudflare-reports-182-million-network.html)
- [Botnet Rising Star: The Evolution and In-Depth Technical Analysis of Dysphoria (QiAnXin XLab)](https://blog.xlab.qianxin.com/botnet-rising-star-the-evolution-and-in-depth-technical-analysis-of-dysphoria/)
- [New Dysphoria DDoS botnet spreads to 200K devices worldwide (BleepingComputer)](https://bleepingcomputer.com/news/security/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide)
- [Shadowserver: CRITICAL: Dysphoria Botnet Special Report](https://www.shadowserver.org/hp-rewrite/a35e45389ec1585eac021dd186906ef9)
- [Multi-Functional Linux Botnet Evooo1Bot (Fortinet FortiGuard Labs)](https://www.fortinet.com/blog/threat-research/multi-functional-linux-botnet-evooo1bot)
- [Evooo1Bot Linux botnet exploits known vulnerabilities (The Hacker News)](https://thehackernews.com/2026/08/evooo1bot-linux-botnet-exploits-known.html)
- [Global law enforcement operation targets AISURU, Kimwolf, JackSkid botnet operators (Security Affairs)](https://securityaffairs.com/189710/cyber-crime/global-law-enforcement-operation-targets-aisuru-kimwolf-jackskid-botnet-operators.html)
- [Cloudflare DDoS Threat Report H1 2026](https://blog.cloudflare.com/ddos-threat-report-2026-h1/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4884