Cybersecurity

CLDAP Floods Surged 580% as DDoS Tactics Shift

Cloudflare's H1 2026 DDoS Threat Report shows attackers moving from raw botnets to DNS and CLDAP reflection attacks that exploit other organizations' misconfigured servers. What that shift means for EU and UK security budgets, and why the government sector's 20-rank jump in targeting is a live warning.

CybersecurityBy Servola Tech Desk2026-08-125 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

CLDAP Floods Surged 580% as DDoS Tactics Shift

Key takeaways

Cloudflare mitigated 23.2 million network-layer DDoS attacks and 29.64 trillion HTTP DDoS requests in H1 2026, roughly 5,343 attacks an hour, but the number worth acting on is different: reflection and amplification techniques are replacing raw botnet floods, so a business's DDoS risk now depends partly on other organizations' misconfigured servers.
DNS Floods rose from 25.7 percent to 40.0 percent of network-layer attacks quarter over quarter, and CLDAP Floods rose 580 percent to become the third most common attack vector, both by bouncing forged requests off open DNS resolvers and exposed LDAP servers rather than requiring the attacker to own a large botnet.
935 individual attacks exceeded 1 terabit per second in H1 2026, a 519 percent jump in that volume from the first quarter to the second, showing that scale is still climbing even as the method behind it changes.
The government sector jumped from rank 29 to rank 9 among the most-targeted sectors, Cloudflare's largest single-sector rank movement recorded so far in 2026, while media and publishing stayed the top target by HTTP DDoS request volume at 14.2 percent and Turkey rose to third most-attacked country around the timing of the NATO summit in Ankara.
Reducing DDoS exposure now means auditing whether your own DNS resolvers and LDAP services are open to the wider internet, and asking your ISP or CDN specifically about blocking amplification vectors, not just buying a bigger connection.

935 Attacks Over 1 Tbps Are the Headline, Not the Story

Cloudflare's DDoS Threat Report for the first half of 2026, published August 11, 2026, put concrete numbers on a year of rising pressure: 23.2 million network-layer DDoS attacks mitigated, 29.64 trillion HTTP DDoS requests blocked, and an average of roughly 5,343 network-layer attacks every hour. The detail that travels fastest is the extreme end: 935 individual attacks exceeded 1 terabit per second in the first half of the year, a 519 percent jump in that volume from the first quarter to the second.

Those numbers are real, and they make headlines. A count of attacks and a count of terabits shows how loud the noise got. It does not show where that traffic came from, and the report's more useful finding sits in that gap: a shift in how attackers built the volume, which changes what a defensible security posture looks like for a company nowhere near a headline.

From Owning a Botnet to Borrowing Someone Else's Servers

Two categories of network-layer attack moved sharply in Cloudflare's data. DNS Floods rose from 25.7 percent of network-layer attacks in the first quarter to 40.0 percent in the second. CLDAP Floods, a reflection and amplification technique, rose 580 percent quarter over quarter and became the third most common attack vector in the report. Both belong to the same family: instead of firing traffic directly from a botnet the attacker controls, the attacker sends a small forged request to a third party's DNS resolver or LDAP server, spoofing the target's address as the sender, and lets that third party's server send a far larger reply at the victim.

The appeal for an attacker is straightforward: these techniques routinely multiply a small request into a much larger response, so a modest amount of attacker bandwidth becomes a large flood at the target. What matters for a defender is where the leverage sits. A classic botnet flood is bounded by how many compromised machines the attacker has assembled. A reflection attack is bounded by how many misconfigured DNS resolvers or exposed LDAP servers exist on the open internet for the attacker to bounce traffic off, and that number sits largely outside any single target's control.

Your Exposure Now Depends on Someone Else's Misconfiguration

That is the operational point worth sitting with. A company can lock down its own perimeter, patch its own servers, and still absorb a larger reflection attack simply because thousands of open DNS resolvers or exposed LDAP servers sit unpatched somewhere else on the internet, available for any attacker to conscript without ever compromising them. DDoS exposure has partly stopped being a function of your own attack surface and become a function of the internet's aggregate hygiene.

That changes what reducing your DDoS risk should mean in practice. Buying a bigger pipe still helps against raw volume, but it does little about being used as a reflector or hit by one. The more useful moves sit upstream and collaborative: egress filtering so your own network cannot be conscripted as someone else's reflector, and a direct conversation with your ISP or CDN about blocking known amplification vectors like DNS and CLDAP at the network edge, rather than only sizing capacity for the last attack you saw.

Government Targeting Jumped 20 Ranks - Watch This, Not History

The most concrete warning in the report is a target, not a technique. The government sector jumped from rank 29 to rank 9 among the most-attacked sectors, Cloudflare's largest single-sector rank movement recorded so far in 2026, a shift the report ties to a campaign it names Operation Epic Fury. Media, production and publishing remained the single most-targeted sector by HTTP DDoS request volume in both quarters, at 14.2 percent of all mitigated HTTP DDoS requests. Turkey rose to the third most-attacked country, which Cloudflare links to the timing of the July NATO summit in Ankara.

None of that is a stable historical pattern a public-sector or public-adjacent organization can shrug off. A 20-rank jump in half a year is a live shift in where attackers are pointing, and it lands hardest on exactly the organizations across the EU and UK, government bodies, utilities, and healthcare-adjacent operators, that tend to run the oldest infrastructure and the thinnest DDoS budgets.

What an EU or UK Operator Should Change This Quarter

Start with an audit, not a purchase. Check whether your own DNS resolvers answer queries from the wider internet rather than only known clients, since an unrestricted resolver is exactly the kind of infrastructure this report says attackers are borrowing. Do the same for any LDAP service exposed beyond your network boundary. Neither fix requires new hardware, both remove you as a potential reflector, and both are the kind of housekeeping a penetration test flags but a busy IT team defers.

Then have the harder conversation with your ISP or CDN provider: ask specifically whether their DDoS mitigation blocks known amplification vectors like DNS and CLDAP floods at the edge, in addition to how much raw volume they can absorb. If you sit in government, utilities, or healthcare-adjacent services, treat the sector's rank jump as current, not historical, and move your DDoS review up the calendar rather than waiting for the next renewal cycle to raise it.

Frequently asked questions

Does a bigger internet connection protect against these attacks?

Only partly. More bandwidth helps absorb raw-volume floods, but it does nothing to stop your own servers from being conscripted as a reflector, and a well-aimed amplification attack can still outpace a standard business connection. Filtering at the ISP or CDN level against known amplification vectors matters more than pipe size alone.

Are we at risk if we are not in government or media?

Yes. DNS and CLDAP reflection techniques do not select targets by industry, they select by what is easiest to bounce traffic off, so any organization reachable over the public internet with real downside from downtime is exposed. Cloudflare's sector rankings show where attackers are currently choosing to spend effort, not the limits of where the technique can reach.

What is a CLDAP flood in plain terms?

Connectionless LDAP is a protocol directory services use to answer lookup queries, and it has historically been left exposed to the open internet more often than it should be. An attacker sends a small forged query to an exposed CLDAP server with the target's address as the sender, and the server sends a much larger reply to the target, amplifying a small amount of attacker traffic into a large flood.

The attack count will keep climbing, and no single organization can outspend that curve alone. The ones that hold up will be the ones that started treating DDoS defense as internet hygiene, their own and their supplier's, well before the next report lands.

CloudflareDDoSDNS amplificationCLDAPgovernment sector targeting

Post-Quantum Now Needs OpenSSL 3.5 on Your Origin

Cloudflare switched on post-quantum authentication to customer origin servers on 29 July. It is the first part of its post-quantum work that does nothing until you change a machine you run yourself.

5 min read

Cybersecurity

The Quantum Deadline Hiding in Your Certificates

Cloudflare will move its signatures to ML-DSA now rather than wait for NIST's nine new candidates. For owners, the trust layer is the slow half of post-quantum.

2 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles