The fourth quarter of 2024 saw an attempted DDoS attack of a whopping 5.6 Terabit per second (Tbps) – the largest attack ever reported.

This is according to Cloudflare’s latest edition of its DDoS Threat Report, which tracked the trends of DDoS attacks across the last quarter of 2024.

The cybersecurity company detected and blocked the record-breaking distributed denial of service attack during the week of Halloween 2024, which was launched by a Mirai-varient that targeted a Internet service provider based in Eastern Asia.

The UDP attack, which lasted only 80 seconds, originated from 13,000 connected devices, with the average unique source IP addresses per second being 5,500 during the attack.

Besides the record-breaking attack, Cloudflare tracked various trends in the last quarter of 2024 from emerging threats to increased volume.

In 2024 as a whole, Cloudflare blocked around 21.3 million DDoS attacks, a 53% increase year on year compared to 2023.

This represents an average of 4,870 blocked attacks every hour.

The fourth quarter showed a marked uptick of hyper-volumetric attacks, those exceeding rates of 1 billion packets per second and 1 Tbps, which grew 1,885% from Q3 to Q4.

In Q4, Cloudflare blocked 6.9m DDoS attacks, 53% of which were HTTP DDoS attacks, while 49% were Layer3/Layer4 DDoS attacks.

The majority (73%) of the HTTP attacks were launched by known botnets, while 11% were pretending to be a known browser, and 10% contained suspicious or unusual HTTP attributes.

For Layer3/Layer 4 or network layer attacks, the top three vectors included SYN floods (38%), DNS flood attacks (16%) and UDP floods (14%).

Recommended reading

• New Report Finds 111% Increase in DDoS Attacks in H1 2024
• 87% of DDoS Attacks Targeted Windows OS Devices in 2023
• New Threat Intelligence Report Shows Global DDoS Surge

Emerging Methods

However, Cloudflare also noted some up-and-coming emerging DDoS attack threats, including Memcachad attacks, which grew by 314% quarter-on-quarter.

Memcached is a caching system used on databases for speeding up networks or websites – those that support UDP can be abused to launch a DDoS attack.

BitTorrent attacks also skyrocketed, with a quarter-on-quarter increase of 304%. These exploit the BitTorrent Protocol, which is used for file sharing between peers, who often will use trackers or Distributed Hash Tables (DHT) to identify peers for file sharing. This can be exploited to launch an attack, Cloudflare explained.