Full Report
Internet services giant Cloudflare says it mitigated a record number of DDoS attacks in 2024, recording a massive 358% year-over-year jump and a 198% quarter-over-quarter increase. [...]
Analysis Summary
# Incident Report: Cloudflare Mitigates Record-Breaking DDoS Attacks in 2025
## Executive Summary
Cloudflare experienced and mitigated a record surge in Distributed Denial of Service (DDoS) attacks throughout 2025, including a peak attack measured at 5.8 Tbps. Attack vectors heavily relied on specialized protocols like CLDAP (UDP-based LDAP) and ESP, exploiting speed and misconfiguration, respectively. While Cloudflare successfully defended against the volumetric attacks, the frequency and scale indicate a significant ongoing threat targeting online services, particularly the gaming sector.
## Incident Details
- **Discovery Date:** Ongoing throughout 2025 (Specific initial date unknown, reporting reflects Q1 trends and recent records).
- **Incident Date:** Ongoing, with a record event occurring late last week (relative to the report date).
- **Affected Organization:** Cloudflare (as the mitigators) and their global customer base, including a specific US-based hosting provider for gaming servers.
- **Sector:** Internet Infrastructure/Security, Hosting, Online Gaming.
- **Geography:** Global, with one specific incident targeting a US-based entity.
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing throughout 2025 Q1 for trending attacks; Record attack occurred "late last week."
- **Vector:** Volumetric flooding utilizing CLDAP (UDP) and ESP attacks; also targeted gaming ports (Port 27015).
- **Details:** CLDAP attacks surged by 3,488% Q/Q, exploiting UDP's lack of handshake for IP spoofing to amplify traffic. ESP attacks grew 2,301% Q/Q due to misconfigurations in exposed systems.
### Lateral Movement
Not applicable, as the attacks detailed are purely volumetric DDoS attacks targeting availability rather than specific internal network traversal.
### Data Exfiltration/Impact
The primary impact was service disruption (Denial of Service), particularly noted against a US-based hosting provider serving Counter-Strike GO, Team Fortress 2, and Half-Life 2: Deathmatch servers. The largest attack peaked at 5.8 Tbps.
### Detection & Response
- **How it was discovered:** Cloudflare's monitoring systems detected the massive influx of malicious traffic.
- **Response actions taken:** Cloudflare mitigated the attacks, including the 5.8 Tbps event, using its global network defenses. The specific gaming attack reached 1.5 Billion packets per second before mitigation.
## Attack Methodology
- **Initial Access:** Volumetric flooding via network layer exploitation (CLDAP/UDP spoofing, ESP attacks).
- **Persistence:** Not applicable (DDoS).
- **Privilege Escalation:** Not applicable (DDoS).
- **Defense Evasion:** Exploiting the speed/lack of handshake in UDP-based protocols like CLDAP to facilitate large-scale spoofing.
- **Credential Access:** Not applicable (DDoS).
- **Discovery:** Not explicitly detailed, though the gaming attack targeted known game services ports (27015).
- **Lateral Movement:** Not applicable (DDoS).
- **Collection:** Not applicable (DDoS).
- **Exfiltration:** Not applicable (DDoS).
- **Impact:** Attempted complete saturation and disruption of target services.
## Impact Assessment
- **Financial:** Not detailed, but high based on the scale of disruption ($5.8 \text{ Tbps}$).
- **Data Breach:** None reported (DDoS event).
- **Operational:** Significant risk of operational downtime, exemplified by the attack on a gaming hosting provider targeting mandatory open ports (27015).
- **Reputational:** Cloudflare’s reputation as a key infrastructure protector is reinforced by its successful mitigation of record events.
## Indicators of Compromise
(Note: IOCs provided are generalized attack characteristics, not specific host artifacts, as this is a network-layer event.)
- **Network indicators (defanged):** High volume UDP traffic directed at services on targeted ports (e.g., 27015/UDP). High traffic spikes resembling CLDAP and ESP signatures.
- **File indicators:** None applicable.
- **Behavioral indicators:** Sudden, massive amplification reflected via IP spoofing, characteristic of high-power DDoS tools.
## Response Actions
- **Containment measures:** Automated traffic filtering and scrubbing mechanisms employed by Cloudflare to absorb and discard malicious packets originating from botnets or spoofed sources.
- **Eradication steps:** Not applicable; focus is on immediate mitigation of the live volumetric threat.
- **Recovery actions:** Restoration of normal service availability for targeted customers post-mitigation.
## Lessons Learned
- **Key takeaways:** DDoS attacks continue to increase in scale, with observed peaks now exceeding $5.5 \text{ Tbps}$. UDP-based reflection/amplification attacks (like CLDAP) are a rapidly growing threat that leverages technical advantages (no handshake) for evasion and amplification.
- **What could have been done better:** The article primarily details successful mitigation, though the fact that attackers are actively calibrating "DDoS cannons" suggests defense mechanisms must continuously scale beyond current empirical records.
## Recommendations
- **Prevention measures for similar incidents:** Stricter ingress filtering must be enforced on all network boundaries to prevent IP spoofing, particularly for UDP-based protocols. Organizations must ensure that only necessary ports are exposed, even if they are common targets (like gaming ports). Continuous stress testing against evolving volumetric threats is required.