Hyper‑Volumetric DDoS Attacks Surge to Record Levels, Reaching 7.3 Tbps

Cloudflare reports historic scale of distributed denial‑of‑service attacks ahead of Q3 2025

In a startling escalation of cyber threat activity, distributed denial‑of‑service (DDoS) attacks have reached previously unimaginable levels—recently peaking at a monumental 7.3 terabits per second (Tbps). The malicious onslaught, detected and mitigated in mid‑May 2025, coincides with a sharp rise in “hyper‑volumetric” attacks—those exceeding 1 Tbps or 1 billion packets per second (Bpps)—according to Cloudflare’s latest security telemetry.

The 7.3 Tbps Event

Cloudflare’s infrastructure, designed to absorb global‑scale cyber threats across its 388 Tbps backbone, repelled this record‑setting assault in under a minute. At its height, the attack unleashed 4.8 billion packets per second, flooding 122,145 source IPs across 5,433 autonomous systems in 161 countries, with Brazil, Vietnam, Taiwan, China, and Indonesia being the top contributors. The brief but intense barrage delivered roughly 37.4 terabytes of data—the visual equivalent to streaming nearly 10,000 HD movies in 45 seconds

Multi‑Vector Attack Composition

The assault featured a multi-pronged strategy:

• 99.996% UDP flood traffic, complemented by
• minor but potent bursts of QOTD, Echo, NTP reflections, Mirai-style UDP floods, portmap floods, and RIPv1 amplification exploits

These complex, hybrid tactics make detection and mitigation even more challenging.

Q2 2025: A Dangerous Inflection Point

Cloudflare reported 6,500+ hyper-volumetric attacks during Q2 2025—averaging 71 high-volume DDoSes each day. Attacks with 100 million pps surged 592% from Q1, while those above 1 billion pps or 1 Tbps doubled—a dramatic 1,150% increase in such mega‑attacks quarter over quarter.

By mid‑2025, Cloudflare had blocked 27.8 million DDoS attempts, surpassing the entire total for 2024 by 30%—a staggering 358% year‑over‑year rise from Q1 alone

Telecommunications: A Primary Target

Once internet and gaming industries dominated the targets list, the telecommunications and service provider sector is now the most frequently hit, especially in the Asia-Pacific region, seeing a 136% YoY surge in Q2 .

Globally, attacks continue to focus on:

1. Telecom/carriers
2. Internet
3. IT services
4. Gaming
5. Banking & finance

Rising Botnet Capabilities

The botnets behind these attacks are scaling like never before. In Q2 alone, an estimated 4.6 million unique devices—nearly 20× larger than any previous botnet—were harnessed . Brazilian devices made up almost 30% of the botnet, followed by the U.S. (12.1%), Vietnam (7.9%), India (2.9%), and Argentina (2.8%)

Notable recent examples include two major incidents: a 6.3 Tbps attack on Brian Krebs’s blog, attributed to the IoT-powered “Aisuru” botnet and earlier, a 5.6 Tbps Mirai‑based DDoS targeting an East Asian ISP in late 2024

Why These Attacks Are More Dangerous

• Short attack durations (typically <60 seconds) minimize analyst response time .
• Automated multi‑vector assaults require real-time, cloud-based mitigation. Manual measures are no longer sufficient
• Global botnet reach increases coordination complexity, reducing predictability.

Defensive Measures & Industry Response

Cloudflare’s strategy involved:

• Autonomous scrubbing across 477 data centers in 293 locations
• Real-time rate‑limiting and multi‑vector scrubbing
• Extensive IP reputation and behavior analytics

This highlights the need for continuous, proactive cyber defenses, especially in the face of AI-augmented botnet campaigns and the exponential rise of IoT-driven attack surfaces

Business Risks & Looking Ahead

These events underline how DDoS attacks have evolved from IT annoyances to core business risks. They threaten global communications, fintech, gaming, media, and essential services. Organizations lacking always-on cloud protections are increasingly exposed.

Cybersecurity leaders recommend:

• AI-powered detection and automated mitigation
• Cloud‑based DDoS defense with hundreds of Tbps of capacity
• Board-level risk discussions backed by threat intel and incident simulations

Without these, companies expose themselves to escalating disruption—and malicious actors targeting business continuity and profitability.