Cloudflare crushes 11.5 Tbps DDoS blitz from Google Cloud

Cloudflare says it has automatically blocked the largest volumetric DDoS attack ever observed, a UDP flood that spiked to 11.5 terabits per second and lasted \~35 seconds. The company added that the traffic mostly originated from Google Cloud and arrived amid “hundreds” of hyper-volumetric attacks seen in recent weeks. (Note: despite the article slug reading “115,” the reported peak is 11.5 Tbps.)

Why this is historic

At 11.5 Tbps, the new peak surpasses Cloudflare’s 7.3 Tbps record disclosed in June 2025 and the 3.8 Tbps bar set in October 2024. Microsoft previously reported a 3.47 Tbps mitigation in 2022. The fresh milestone shows attack capacity is still climbing, fast.

Anatomy of the blast

Vector: UDP flood (bandwidth-saturating, connectionless packets).
Burstiness: \~35s duration, consistent with recent short, high-intensity “hyper-volumetric” surges.
Scale: Cloudflare noted peaks of 5.1 Bpps (billions of packets per second) alongside 11.5 Tbps during the recent wave.
Source profile: “Mainly” from Google Cloud—typical of today’s DDoS where abused cloud instances can marshal enormous, transient firepower.

How Cloudflare absorbed it—at wire speed

Cloudflare’s mitigation is autonomous and distributed. Each edge server runs the in-house `dosd` (denial-of-service daemon) for instant detection and filtering, complemented by `flowtrackd` for stateful protection of complex flows. Decisions happen at the edge without centralized consensus, cutting reaction times to seconds. The scale rides on a 405 Tbps Anycast network designed to soak bandwidth floods before they localize impact.

The broader trend: hyper-volumetric is the new normal

Cloudflare’s recent threat reports chart an aggressive rise in volumetric events. In Q2 2025, it recorded the then-largest 7.3 Tbps and 4.8 Bpps attacks while blocking 6,500+ hyper-volumetric events that quarter. Earlier, Cloudflare tallied 21.3 million DDoS mitigations across 2024 and 20.5 million in Q1 2025 alone, including 6.6 million strikes directly against its own backbone in an 18-day multi-vector campaign. The new 11.5 Tbps spike extends that arc.

How it compares—recent records at a glance

Sep 2025: 11.5 Tbps UDP flood, mostly from Google Cloud; \~35s.
May/Jun 2025: 7.3 Tbps attack on a hosting provider; \~45s; largely UDP; “carpet-bombing” across many ports.
Oct 2024: 3.8 Tbps / \~65s hyper-volumetric L3/4 campaign.
Jan 2022: 3.47 Tbps on an Azure customer (Microsoft).

What this means for defenders (actionable takeaways)

Assume bursts, not sieges. Modern floods compress devastating throughput into sub-minute windows; tune detection & alerting for seconds-level granularity.
Push filtering to the edge. On-prem scrubbing alone can be too late. Prefer always-on, autonomous mitigation with global Anycast capacity.
Harden UDP exposure. Inventory UDP services, restrict to business-critical ports, and apply stateless filters / rate limits close to ingress.
Spoofing resistance upstream. Work with ISPs and cloud partners on ingress filtering and abuse handling to blunt reflection/amplification potential. (Industry best practice; aligns with provider guidance.)
Exercise runbooks for 30–60s shocks. Simulate hyper-volumetric bursts to validate telemetry, auto-mitigation, and comms in the first minute.

Open questions we’re watching

Victim & motive: The target of the 11.5 Tbps surge wasn’t named; attribution and motive remain unconfirmed.
Abuse pathways in cloud: How attackers marshalled such momentary scale from Google Cloud—and what countermeasures follow—will shape future resilience.

Bottom line

The 11.5 Tbps peak is a step-change, not a blip. Short, furious floods launched from powerful cloud footprints are redefining DDoS economics. Cloudflare’s autonomous edge and massive Anycast backbone proved decisive this time; everyone else should calibrate defenses to match the new tempo.

Cloudflare crushes 11.5 Tbps DDoS blitz from Google Cloud

Related threat feeds

Pakistan Law Enforcement Agencies Targeted in Alleged Multi Group Cyber Espionage Operations