Forty seconds is barely enough time to read this paragraph aloud.
Yet that is all it took for a wave of junk traffic to become, for a moment, the biggest cyberattack anyone had ever measured.
No alarms blared in an office somewhere.
No analyst stared at a screen in real time.
A machine simply noticed the surge, matched it against known attack patterns and started shutting doors before a human could blink.
What built that flood, and why did it vanish again before most networks even noticed?
How a flood this size gets built in seconds
The attack behind the record was what security engineers call a UDP flood, a blunt but effective trick of sending a target so many tiny data packets that its systems burn through their own resources just trying to process them. Because UDP packets are small and the receiver spends resources trying to process them, attackers increase the packet rate to deplete those resources and take down the target. The method is old, but the raw scale involved was not.
Cloudflare, the web infrastructure company whose network sits in front of millions of sites, has autonomously mitigated the largest recorded DDoS attack in internet history, absorbing an unprecedented 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps) in malicious traffic. The attack was more than double the size of any previously observed DDoS event, and the previous record was an 11.5 terabits per second UDP flood attack set only weeks earlier.
So where does traffic like that come from? Not from a handful of powerful servers, but from an army of ordinary household gadgets. Although Cloudflare has not shared details about the origin of the attack, a previous record attack was attributed to the AISURU botnet , a Mirai-descended network that researchers found spreads through hijacked home routers, security cameras and DVRs still running default passwords or outdated firmware. Whether this larger, 22.2 Tbps attack was a continuation of AISURU’s activity or the emergence of a new botnet remains unclear.
Each device sends only a trickle of traffic on its own. But that network of infected devices is believed to have affected more than 300,000 systems worldwide around that time, enough that their combined trickle adds up to a firehose strong enough to knock almost anything offline, a dynamic our coverage of software supply-chain weak points has tracked from a different angle.
Inside the 40 seconds that broke the record
Picture the attack as a dam bursting rather than a tide rising. The attack curve shared by Cloudflare shows a sharp climb to over 22 Tbps, sustained for roughly 35 seconds before dropping abruptly, indicating a concentrated flood from highly coordinated infrastructure.
That shape is deliberate. The entire event lasted only about 40 seconds, a tactic designed to overwhelm defenses before they have a chance to respond fully, as attackers increasingly use these hit-and-run DDoS attacks to cause maximum disruption in a minimal timeframe.
The attack did not name its target to the public. Cloudflare told SecurityWeek that the attack was aimed at a single IP address of an unnamed European network infrastructure company , and the company’s public statement focused on the defensive outcome rather than the victim, since naming a target can invite copycat attempts.
What is public is the trajectory. The development came a little over two months after Cloudflare said it blocked in mid-May 2025 a DDoS attack that hit a peak of 7.3 Tbps targeting an unnamed hosting provider. Barely three weeks after the 11.5 Tbps attack, a bigger wave hit.
The evidence trail that confirms the climb
This was not a one-off spike but the latest rung on a ladder that was climbing fast through the second half of 2025. The May 2025 attack delivered its own share of alarm, but Cloudflare’s own reporting called the volume of these bursts extreme for how quickly they arrive. That record held for only months.
Then came September, when Cloudflare said it automatically mitigated a record-setting volumetric DDoS attack that peaked at 11.5 terabits per second , according to the company’s own disclosure covered by The Hacker News. The entire attack lasted only about 35 seconds. That record lasted barely three weeks before the 22.2 Tbps event eclipsed it.
Security researchers have since tied that earlier 11.5 Tbps wave to a botnet known as AISURU, a Mirai-descended network that a Totolink router firmware update server breach in April let the operators expand, with the botnet swelling past 100,000 nodes and ultimately peaking at approximately 300,000 infected routers worldwide. Cloudflare’s own later threat reporting found the botnet’s reach had grown far beyond that original footprint, with the operators estimated to control between 1 and 4 million infected hosts by the time the record climbed again months later.
Multiple outlets covering the same disclosure, including Security Affairs, reported the identical 22.2 Tbps and 10.6 billion packet-per-second figures, giving the claim more than one independent confirmation.
Where this record runs into its limits
Even a record this large has a catch worth noting. The attack lasted only seconds, which means raw peak bandwidth tells only part of the story.
