New DDoS peak value: 29.7 Terabits per second

Cloudflare has published its Q3 2025 Threat Report. Among other things, the company reports a new peak value for a DDoS (Distributed Denial of Service) attack, an overload attack on servers on the internet. This reached a strength of 29.7 Terabits per second.

As Cloudflare writes in its blog post, this attack originated from the Aisuru botnet. It consists of an estimated one to four million infected devices worldwide and was responsible for a DDoS attack on the website of IT security journalist Brian Krebs around May. Routinely, Aisuru unleashes high-volume DDoS attacks exceeding 1 Terabit per second and 1 billion packets per second, write Cloudflare's IT researchers. They observed an increase of more than 50 percent compared to the previous quarter, with an average of 14 such high-volume attacks per day. The peak was marked by the aforementioned attack, with 29.7 TBit/s and 14.1 billion packets per second. It was an "UDP carpet bombing attack" targeting 15,000 ports per second.

Significant Increase in DDoS Attacks

According to Cloudflare, some other highlights include the significant increase in attacks against AI companies. Compared to previous months, the company saw an increase of around 350 percent in September 2025. Furthermore, a significant increase in attacks against companies in mining, mineral, and metal extraction was observed, coinciding with tensions between the EU and China regarding rare earths and tariffs on electric car imports.

In total, Cloudflare's automated systems repelled 8.3 million DDoS attacks in the third quarter of 2025. This corresponds to 3780 DDoS attacks every single hour. Quarter-over-quarter, the number of attacks increased by 15 percent, and year-over-year, it even increased by 40 percent.

Cloudflare also discusses the distribution across different DDoS attack vectors. Most are relatively short and ended after about 10 minutes. UDP DDoS attacks increased by 231 percent compared to the previous quarter, making up the main proportion of network-level attacks. DNS floods were in second place, SYN floods in third, and ICMP floods in fourth. Over the entire year 2025, there were 10.3 million HTTP DDoS attacks and 25.9 L3/L4 DDoS attacks, i.e., those at the network level, that Cloudflare could observe with its systems.

The known record values for DDoS attacks were previously reported in mid-November by Microsoft with 15.7 TBit/s and 3.64 billion packets per second. Just a few months earlier, in September, the peak value was still 11.5 TBit/s with 5.1 billion packets per second.

(dmk)