CloudFlare detected (and blocked) the biggest DDoS attack on record | CyberScoop<\/title> <meta name=\"description\" content=\"Cloudflare detected the biggest DDoS attack ever recorded, a 5.6 terabits per second (Tbps) attack directed at an ISP in Eastern Asia.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/cloudflare-biggest-ddos-attack-mirai-variant-botnet\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"CloudFlare detected (and blocked) the biggest DDoS attack on record\"> <meta property=\"og:description\" content=\"Cloudflare detected the biggest DDoS attack ever recorded, a 5.6 terabits per second (Tbps) attack directed at an ISP in Eastern Asia.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/cloudflare-biggest-ddos-attack-mirai-variant-botnet\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2025-01-22T16:13:29+00:00\"> <meta property=\"article:modified_time\" content=\"2025-01-22T16:13:45+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1024\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Greg Otto\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@gregotto\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1732206022g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1736472017g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1737070850g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=cc5cb8dd0a9ba2b865c4\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/83217\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=83217\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fcloudflare-biggest-ddos-attack-mirai-variant-botnet%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fcloudflare-biggest-ddos-attack-mirai-variant-botnet%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-83217 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/cloudflare-biggest-ddos-attack-mirai-variant-botnet\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"5.12\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Nominations can be submitted for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.392950391645\">\n<div class=\"single-article__header-content\" readability=\"34.434782608696\">\n<p> The company said that the 5.6 Tbps attack is indicative of the steady increase in the size of these attacks. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/83217\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"341\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record.jpg?resize=640%2C341&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt=\"botnet, attack, ddos, red team, mykings\" decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-2.jpg?resize=300,160 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-2.jpg?resize=768,410 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-2.jpg?resize=1024,546 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-2.jpg?resize=1536,819 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-2.jpg?resize=600,320 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-2.jpg?resize=1200,640 1200w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-2.jpg?resize=1500,800 1500w\" sizes=\"(max-width: 1200px) 100vw, 1200px\"><figcaption> (Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"32.300943920044\"><body readability=\"65.220830586684\"><\/p>\n<p>Web infrastructure and security company Cloudflare says it detected the biggest Distributed Denial-of-Service (DDoS) attack ever recorded, a 5.6 terabits per second (Tbps) attack directed at an internet service provider (ISP) in Eastern Asia. Despite the staggering volume of the attack, Cloudflare successfully managed and mitigated it without human intervention.<\/p>\n<p>The company said in research released Tuesday that the attack, which was launched with a variant of the Mirai botnet, originated from over 13,000 Internet of Things (IoT) devices. The attack aimed to overwhelm the ISP\u2019s servers with UDP (User Datagram Protocol) traffic, potentially forcing them offline. However, Cloudflare\u2019s automated defense systems stopped the attack from ever causing a problem for the ISP\u2019s operations.<\/p>\n<p>\u201cIt required no human intervention, didn\u2019t trigger any alerts, and didn\u2019t cause any performance degradation,\u201d Cloudflare <a href=\"https:\/\/blog.cloudflare.com\/ddos-threat-report-for-2024-q4\/#the-largest-ddos-attack-on-record\">wrote in a blog<\/a>. \u201cThe systems worked as intended.\u201d <\/p>\n<p>While the attack was quite large, the company said it wasn\u2019t an isolated incident. The company says there was a 53% increase in DDoS threats in 2024 compared to the previous year, with Cloudflare\u2019s tech blocking approximately 21.3 million DDoS attacks over 12 months. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Notably, Cloudflare\u2019s findings revealed a dramatic 1,885% surge in attacks exceeding 1 Tbps between the third and fourth quarters of 2024. This heightened activity underscores an escalating trend of \u201chyper-volumetric\u201d DDoS attacks, which allow for hundreds of millions of packets per second to be directed at a target. <\/p>\n<p>The large-scale attacks have grown as botnets have grown, particularly those leveraging variants of the Mirai malware. Since its 2016 inception, it\u2019s been tough to determine how many variants have been created. In the past few years, research has shown there has been <a href=\"https:\/\/www.darkreading.com\/vulnerabilities-threats\/7-variants-so-far-of-mirai\">anywhere from seven<\/a> to <a href=\"https:\/\/www.botconf.eu\/botconf-presentation-or-article\/how-many-mirai-variants-are-there\/\">over 200 different variants<\/a>. Fittingly, cybersecurity firm Qualys released new research Tuesday that found <a href=\"https:\/\/blog.qualys.com\/vulnerabilities-threat-research\/2025\/01\/21\/mass-campaign-of-murdoc-botnet-mirai-a-new-variant-of-corona-mirai\">another Mirai variant targeting<\/a> AVTECH Cameras and Huawei HG532 routers.<\/p>\n<p>While the magnitude of DDoS attacks has reached new heights, their duration has notably decreased. Cloudflare said approximately 72% of HTTP-based and 91% of network layer DDoS attacks ended in less than 10 minutes, posing significant challenges for traditional mitigation strategies, which often require human analysis and intervention.<\/p>\n<p>These brief-yet-intense assaults commonly coincide with peak internet usage periods \u2014 holidays and large-scale events \u2014 maximizing potential disruption. Cloudflare says the sharp rise in ransom-driven DDoS attacks, peaking in the last quarter of 2024, further adds to the complexity and persistent threat landscape.<\/p>\n<p>\u201cToo many organizations only implement DDoS protection after suffering an attack,\u201d the company remarked in its blog. \u201cOur observations show that organizations with proactive security strategies are more resilient.\u201d <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>You can read the full research <a href=\"https:\/\/blog.cloudflare.com\/ddos-threat-report-for-2024-q4\/#the-largest-ddos-attack-on-record\">report on Cloudflare\u2019s website<\/a>. <\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"4.0555555555556\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record-1.jpg?w=640&ssl=1\" alt=\"Greg Otto\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Greg Otto<\/h4>\n<p> Greg Otto is Editor-in-Chief of CyberScoop, overseeing all editorial content for the website. Greg has led cybersecurity coverage that has won various awards, including accolades from the Society of Professional Journalists and the American Society of Business Publication Editors. Prior to joining Scoop News Group, Greg worked for the Washington Business Journal, U.S. News & World Report and WTOP Radio. He has a degree in broadcast journalism from Temple University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/cloudflare-biggest-ddos-attack-mirai-variant-botnet\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>CloudFlare detected (and blocked) the biggest DDoS attack on record<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2080,632,78,174,1690,3524,3525,256,288],"tags":[2082,633,86,178,1692,3526,3527,262,294],"class_list":["post-7025","post","type-post","status-publish","format-standard","hentry","category-botnets","category-cloudflare","category-cybersecurity","category-ddos","category-internet-of-things-iot","category-mirai","category-qualys","category-research","category-threats","tag-botnets","tag-cloudflare","tag-cybersecurity","tag-ddos","tag-internet-of-things-iot","tag-mirai","tag-qualys","tag-research","tag-threats"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/botnets\/\" rel=\"category tag\">botnets<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cloudflare\/\" rel=\"category tag\">Cloudflare<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ddos\/\" rel=\"category tag\">DDoS<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/internet-of-things-iot\/\" rel=\"category tag\">Internet of Things (IoT)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/mirai\/\" rel=\"category tag\">Mirai<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/qualys\/\" rel=\"category tag\">Qualys<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/research\/\" rel=\"category tag\">Research<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a>","tag_info":"Threats","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7025","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7025"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7025\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7025"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7025"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7025"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7025,"date":"2025-01-22T10:13:29","date_gmt":"2025-01-22T16:13:29","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=83217"},"modified":"2025-01-22T10:13:29","modified_gmt":"2025-01-22T16:13:29","slug":"cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/01\/22\/cloudflare-detected-and-blocked-the-biggest-ddos-attack-on-record\/","title":{"rendered":"CloudFlare detected (and blocked) the biggest DDoS attack on record"},"content":{"rendered":"