Security News Cloudflare tracked 230 billion daily threats and here is what it found

[Miravi]

Content source

https://www.helpnetsecurity.com/2026/03/03/cloudflare-cyber-threat-report-2026/

Cloudflare’s network blocks over 230 billion threats per day. The volume indicates how routine and automated the attack cycle has become, and the patterns behind that volume point to a shift in how breaches begin and progress.

Cloudflare’s threat research unit, Cloudforce One, published its inaugural cyber threat report 2026, covering activity observed through 2025 and projecting into the year ahead. The report draws on telemetry from Cloudflare’s network, which handles roughly 20% of global web traffic.

“Threat actors are constantly changing tactics, finding new vulnerabilities to exploit and ways to overwhelm their victims. To avoid being caught off guard, organizations must shift from a reactive posture to one fueled by real-time, actionable intelligence,” said Blake Darché, head of threat intelligence, Cloudforce One at Cloudflare.

Stolen sessions are replacing credential guessing​

Infostealers such as LummaC2 extract live session tokens from infected machines rather than stored passwords. Those tokens give attackers access to already-authenticated sessions, bypassing MFA entirely. According to the report, 54% of ransomware attacks in 2025 traced back to infostealer-enabled credential theft, citing Verizon’s 2025 Data Breach Investigations Report.

Cloudforce One participated in a coordinated global operation in May 2025 to disrupt LummaC2 infrastructure, deploying warning pages across malicious command-and-control domains. The unit is already tracking successor variants expected to automate the time between infection and ransomware deployment down to hours.

Bots account for 94% of all login attempts observed on Cloudflare’s network. Of human login attempts, 46% involve credentials that have already been compromised in prior breaches. These figures reflect the scale at which automated credential testing operates across the web.

Cloud platforms are being used as attack infrastructure​

Threat actors across multiple nation-state categories are routing malicious activity through legitimate cloud services including AWS, Google Cloud, Azure, and SaaS platforms like Google Calendar and Dropbox. This approach blends attack traffic with normal enterprise usage, making detection harder for network security teams.

Cloudforce One tracks this tactic under the label “Living off the XaaS,” or LotX. Chinese-affiliated groups identified in the report use Google Calendar event descriptions to pass encrypted commands to infected hosts, and exploit F5 and VMware infrastructure for long-term persistence. Iranian-linked groups host command-and-control pages on Azure Web Apps.

Salt Typhoon and Linen Typhoon, both linked to China, continued targeting North American telecommunications providers, government networks, and IT services through 2025. The report attributes breaches at AT&T, Verizon, and Lumen to this activity, along with a July 2025 Microsoft SharePoint compromise. The targeting pattern indicates a focus on persistent access to critical infrastructure for potential future disruption.

Email authentication gaps are enabling phishing at scale​

An analysis of 450 million emails found that 43% failed SPF checks, over 44% lacked valid DKIM signatures, and 46% failed DMARC. These gaps allow Phishing-as-a-Service bots to exploit incomplete authentication chains and deliver spoofed messages that appear to come from trusted internal or branded sources.

The top impersonated brands in phishing campaigns were Windows, SANS, Microsoft, Stripe, and Facebook. Researchers also intercepted over $123 million in BEC financial theft attempts in 2025. The average attempt sat at approximately $49,225, a figure the report attributes to deliberate calibration by fraudsters targeting amounts below executive approval thresholds.

DDoS volumes reached new records in 2025​

The total number of DDoS attacks observed by Cloudflare more than doubled in 2025 to 47.1 million. Network-layer attacks more than tripled year over year. Cloudforce One recorded 19 new world-record attacks during the year. The largest, a 31.4 Tbps UDP flood launched by the Aisuru botnet in November 2025, was nearly six times the peak volume of the largest attack recorded in 2024.

Most attacks in 2025 lasted under 10 minutes, closing the practical window for human-led mitigation. The Aisuru botnet and its successor Kimwolf collectively control an estimated one to four million infected hosts. The report notes that Kimwolf saw over 550 command-and-control nodes null-routed in early 2026.

North Korean operatives are embedding in remote workforces​

State-sponsored operatives linked to North Korea are obtaining employment at Western organizations using AI-generated deepfake profiles and U.S.-based laptop farms that create the appearance of domestic residency. Once hired, these workers funnel salary revenue back to the regime and can introduce malicious access to internal systems. The report identifies detection indicators including impossible travel login alerts, mouse-jiggling software, and video metadata artifacts consistent with real-time deepfake rendering.

Manufacturing and critical infrastructure accounted for over 50% of ransomware-targeted attacks in 2025, driven by the high cost of operational downtime in those sectors.

Cloudflare tracked 230 billion daily threats and here is what it found - Help Net Security

The 2026 cyber threat report reveals attackers using stolen session tokens, AI tools, and cloud platforms to breach organizations fast.

www.helpnetsecurity.com

 

[Halp2001]

Daily habits are fundamental for our digital protection. Some weigh more than others, but three simple gestures can make a real difference:

• Use different emails depending on the type of account, so one breach doesn’t open every door.
• Check your active sessions from time to time and close the ones you no longer need.
• Take a pause before opening suspicious emails: calmness is often the best filter against deception… and if doubt persists, run them through an online scanner, especially when your antivirus doesn’t give you a clear spoiler.

They’re not magic formulas, but small routines that make attackers look for an easier target.

 

[Sorrento]

Not sure how Cloudstrike in Nord helps but its likely better than a smack in the face I would think - Along with Kaspersky Standard gives reasonable protection with ublock, every little helps I'm thinking, along always with using the big thing between my ears (not my nose)

 

[ForgottenSeer 123960]

NIST & SANS Defense Architecture

EXECUTIVE SYNTHESIS
Federal standards (NIST) and industry training authorities (SANS) mandate a decisive shift away from perimeter-based security and legacy authentication. The defense against modern automation, deepfake injection, and cloud-native abuse requires the implementation of Zero Trust Architecture (ZTA), phishing-resistant identity proofing with biometric liveness checks, and rigorous domain-level email cryptography.

Defending Against Session Hijacking & MFA Bypass

NIST Guidance
NIST Special Publication 800-207 (Zero Trust Architecture) dictates that no implicit trust should be granted to assets or user accounts based on prior authentication. System access must be continuously evaluated focusing on protecting resources rather than network segments. Furthermore, NIST SP 800-63B (Authentication Assurance Level 2/3) explicitly mandates transitioning to phishing-resistant MFA (e.g., FIDO2/WebAuthn) to negate the value of stolen session tokens and passwords.

SANS Guidance
SANS recommends validating both the user and the system for every requested connection. Defenses must include actively uniformly disabling inactive accounts on Active Directory and MFA systems, and implementing behavioral monitoring to detect impossible travel or anomalous session token reuse.

Defending Against LotX (Living off the XaaS/Cloud)

SANS Guidance
SANS Institute Director of Intelligence Katie Nickels labels this "Living Off the Cloud." Because adversaries blend in with legitimate traffic (AWS, Azure, Google Drive), defenders must adopt a "Know normal, find evil" mindset. This requires establishing strict behavioral baselines for cloud resource usage to spot anomalies.

NIST Guidance
NIST SP 800-228 (Guidelines for API Protection for Cloud-Native Systems) recommends implementing advanced runtime protections on Cloud APIs, strictly managing Identity Canonicalization, and mitigating the "Confused Deputy" problem where legitimate cloud services are tricked into executing malicious commands.

Defending Against AI Deepfake Remote Worker Infiltration

NIST Guidance
Within the drafting of NIST SP 800-63-4 (Digital Identity Guidelines), defense against scaled synthetic identity and deepfake attacks requires shifting away from easily forged Knowledge-Based Authentication (KBA). Identity resolution must incorporate many duplicate face checks and Presentation Attack Detection (PAD) biometrics (to detect screen replays or masks). Additionally, NIST recommends "geofencing" and geographic device compliance tools during the identity proofing and remote hiring phases.

SANS Guidance
SANS emphasizes human-element awareness combined with rigorous architectural limits. Systems granted to remote entities must be heavily isolated, strictly governed by Least Privilege, and monitored by Endpoint Detection and Response (EDR) to catch the behavioral output of the threat actor once the deepfake barrier is bypassed.

Defending Against Email Spoofing & Phishing-as-a-Service

NIST Guidance
NIST Special Publication 800-177 (Trustworthy Email) establishes the core triad for authenticating sending domains: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Organizations must configure DMARC policies to strictly reject (`p=reject`) unauthorized mail to prevent cryptographic spoofing.

SANS Guidance
SANS instructors explicitly note that configuring DMARC/SPF/DKIM is only step one. Defenders must pair these protocols with active email tagging, quarantine capabilities, and a seamless one-button reporting widget for users to flag Business Email Compromise (BEC) attempts that slip through the cryptographic net.

EXECUTIVE SYNTHESIS (Home Users)
The democratization of cybercrime means home users now face the same automated attacks as Fortune 500 companies. However, consumers lack enterprise security teams. Defense at the home level relies on adopting cryptographic authenticators (Passkeys), establishing out-of-band verification protocols with family members, and maintaining a "Zero Trust" mindset toward inbound communications, regardless of how legitimate the sender or cloud hosting platform appears.

Defending Against Infostealers & Session Hijacking (Home Users)

Stop Browser Storage
Infostealer malware specifically targets credentials and session cookies stored locally in Chrome, Edge, or Safari. Home users should migrate to dedicated, encrypted Password Managers rather than relying on built-in browser autofill. [Source Lock: SpyCloud 2025 Identity Threat Report / CISA Security Guidelines]

Upgrade to Passkeys
To defeat session theft and MFA bypass, consumers should replace vulnerable SMS text-message codes with Passkeys (using smartphone biometrics) or physical FIDO2 security keys (like YubiKey) for their primary email, banking, and crypto accounts. [Source Lock: CISA Google Workspace Common Controls - Phishing Resistant MFA]

Defending Against LotX / Cloud Infrastructure Abuse (Home Users)

Trust the Sender, Not the Link
Because attackers host malware on legitimate platforms (Google Drive, Dropbox, OneDrive), you cannot assume a link is safe just because the URL has a trusted domain.

Actionable Defense
Never download or execute .exe, .scr, or .zip files linked from unexpected emails, even if hosted on a recognized cloud provider. Ensure built-in OS defenses (Windows Defender, Apple XProtect) are active and set to scan all downloads automatically. [Source Lock: CISA Avoiding Social Engineering and Phishing Attacks]

Defending Against AI Deepfakes & Voice Cloning (Home Users)

The "Family Safe Word"
The FTC warns that AI voice cloning is heavily used in "Grandparent Scams" to fake kidnappings or arrests. Families must establish an offline, predetermined "safe word." [Source Lock: FTC Consumer Protection - Imposter Scams]

Out-of-Band Verification
If a relative calls in distress demanding immediate funds, hang up. Redial the person directly using their known, saved phone number.

Payment Red Flags
No legitimate government agency, utility company, or bail bondsman will ever demand payment via Cryptocurrency, Wire Transfer, or Prepaid Gift Cards. [Source Lock: FTC Consumer Protection]

Defending Against Phishing & Spoofing (Home Users)

Defeat the Urgency Trigger
Phishing relies on amygdala hijacking (inducing fear or urgency). SANS Institute's consumer awareness program emphasizes pausing before reacting to emails threatening account closure or legal action.

Direct Navigation
Because email addresses and caller IDs are easily spoofed, home users should never click links to resolve account issues. Instead, manually type the organization's URL (e.g., paypal.com or chase.com) directly into a clean browser window to check for alerts. [Source Lock: SANS OUCH! Consumer Security Awareness]

Sources
"NIST SP 800-207"
"NIST SP 800-177"
"NIST SP 800-228"
"NIST SP 800-63"
"SANS Cyber Defense & Cloud Intelligence Briefings