Threat video1:00
Cloudflare Q3 2026 DDoS Threat Report: Detection & IOCs
Cloudflare counted 18.2M DDoS attacks in Q3, led by Dysphoria and Evooo1Bot; 27 IOCs and 9 detection rules, incl. a free Splunk SPL rule.
Read the full threat intel for Cloudflare Q3 2026 DDoS Threat Report: Detection & IOCs →
Chapters
- 0:00The hook18.2 million attacks, up 38 percent.
- 0:04The storyDysphoria and Evooo1Bot led the surge.
- 0:11Attack pathDysphoria infects IoT, then persists on the device.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise25 indicators to hunt: 6 IPs, 12 domains and 1 URL, and more.
- 0:38MITRE ATT&CK techniques16 ATT&CK techniques, from resource development to impact.
- 0:43Remediation4 steps now: Enable always-on, automated DDoS mitigation that does not depend.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0018.2 million attacks, up 38 percent.
0:05Dysphoria and Evooo1Bot led the surge.
0:08Short-burst attacks rose 208%.
0:11Dysphoria infects IoT, then persists on the device.
0:15Blockchain-based C-two controls 200,000 enrolled bots.
0:19Short-burst attacks up 208%; DNS floods up 215%.
0:26No threat actor is attributed. Confidence: low.
0:3125 indicators to hunt: 6 IPs, 12 domains and 1 URL, and more.
0:3816 ATT&CK techniques, from resource development to impact.
0:434 steps now: Enable always-on, automated DDoS mitigation that does not depend.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.