02.09.2025
2 min
547
Cloudflare said it had automatically stopped the company’s largest ever DDoS attack, an 11.5 terabit per second (Tbps) attack that lasted 35 seconds and consisted of a massive UDP flood.
Cloudflare said it had autonomously stopped hundreds of hyperscale attacks in recent weeks, including one that reached speeds of up to 5.1 billion packets per second. The most recent attack originated primarily from Google Cloud infrastructure and was intended to completely overload targeted servers.
DDoS attacks of this magnitude can cause packet loss, service disruptions, and network service failures. Experts explain that attackers are increasingly using such attacks as “smoke screens” to distract security teams and simultaneously conduct multi-vector attacks to steal data or access critical systems.
This incident occurred two months after Cloudflare stopped a 7.3 Tbps attack in May 2025. According to the company, in the second quarter of 2025, the number of L3/4 hyper-volume attacks (over 1 Tbps or 1 billion pps) increased to 6,500 cases, which is ten times more than in the first quarter.
The record-breaking attack was partly due to the activity of RapperBot, which infects network video recorders and IoT devices, turning them into DDoS botnets. The attackers used web server vulnerabilities and fake firmware updates to spread the malware. RapperBot then connected to C2 servers via DNS TXT records and received commands for massive attacks. Researchers note that RapperBot works according to a simple scheme: it scans the Internet for outdated devices, brute-forces or exploits them, and then infects again and again, as vulnerable machines constantly appear on the network.
The 11.5 Tbps attack shows that even taking down individual botnets does not stop the overall trend of increasing DDoS scale. Companies should view such attacks not only as a denial-of-service threat, but also as part of a more complex scenario that combines distraction and targeted cyberattacks.
