Cloudflare Neutralizes Record 2 Tbps Multi-Vector DDoS Attack

Cloudflare has disclosed that its automated defenses recently intercepted and neutralized a distributed denial-of-service (DDoS) attack peaking at just under 2 Tbps—the largest the company has observed to date. The assault, which lasted a total of one minute, employed a multi-vector strategy that combined DNS amplification techniques with UDP floods.

According to Cloudflare, the attack originated from a botnet of roughly 15,000 devices running a variant of the original Mirai malware. The compromised fleet included IoT devices as well as unpatched GitLab instances, which were exploited via a known remote code execution vulnerability (CVE-2021-22205).

Attack Intensity Continues to Climb

This event underscores an ongoing trend of escalating attack power. Cloudflare's Q3 DDoS Trends report noted that network-layer DDoS attacks increased by 44% quarter-over-quarter. Although Q4 data is not yet final, the company states that it has already recorded multiple terabit-scale assaults targeting its customers, including this latest near-2 Tbps event.

How the Mitigation Unfolded

Cloudflare's defense architecture relies on continuous, out-of-path analysis of traffic samples. This asynchronous method allows the system to detect anomalies without introducing latency to legitimate requests. In this incident, the detection was completed within sub-seconds, after which the system automatically generated a real-time signature specifically tailored to match the characteristics of the incoming attack traffic.

This fingerprint was then propagated as an ephemeral mitigation rule to the most strategically efficient point on Cloudflare's edge network. For this particular layer 3/4 attack—as is typical for such volumetric floods—the rule was deployed in-line within the Linux kernel's eXpress Data Path (XDP). This approach enabled the edge to drop malicious packets at wire speed while leaving legitimate traffic untouched.

Prevention at Scale

The company frames this mitigation within its broader mission of securing the Internet. Cloudflare points to its track record of combating various large-scale threats, including the Meris botnet, which was responsible for some of the largest HTTP DDoS attacks ever recorded, and recent targeted campaigns against VoIP providers. In all of these cases, the company's network has relied on automated, real-time detection and response systems to filter attacks so that customers experience minimal disruption.