Cloudflare disclosed on Monday that it mitigated a volumetric attack peaking at 12.4 terabits per second on July 19, directed at a single European retail bank the company declined to name. The burst lasted 41 seconds and was fully absorbed by automated systems with no human intervention and no measurable impact on the customer's origin. What makes this one worth reading about is the source. The traffic came overwhelmingly from compromised carrier-grade fiber routers in residential deployments rather than the cameras and DVRs that have powered every record-setting botnet since Mirai in 2016. Those routers have symmetric gigabit uplinks, which changes the arithmetic of what a botnet can produce.
The anatomy of the attack
Cloudflare's traffic analysis counted roughly 118,000 distinct source addresses, a small number by botnet standards. Previous records involved millions of devices each contributing a trickle. Here each node pushed an average of 105 megabits per second, which is what happens when the compromised device sits behind a fiber connection rather than a consumer cable modem. The composition was 71 percent UDP flood, 22 percent DNS amplification against open resolvers, and the remainder TCP SYN traffic that appeared designed to consume state on middleboxes rather than bandwidth.
Geographic distribution clustered in three countries with large recent fiber rollouts, which Cloudflare identified only as being in Southeast Asia and Eastern Europe. The device fingerprints point to two specific optical network terminal models from a single Chinese manufacturer, both running firmware with a hardcoded management credential that a researcher disclosed in March and that the vendor has not patched for units already deployed. Internet service providers who bought those units in bulk now have a supply chain problem they cannot fix remotely.
Why 41 seconds is the interesting number
Short attacks are a deliberate strategy. A burst that ends before an on-call engineer finishes reading the page defeats manual mitigation entirely, and it stays below the detection thresholds that many scrubbing services use to trigger a customer notification. Cloudflare's data shows attacks under a minute now represent 89 percent of all volumetric events it sees, up from 63 percent two years ago. Attackers learned that sustained floods invite coordinated takedowns while short bursts cause the same customer pain with less exposure.
The defensive consequence is that anything requiring a human decision has already failed. Cloudflare's mitigation engaged in under three seconds through fingerprint matching at the edge, with no operator involved. Companies still running an architecture where a DDoS triggers a phone call to a provider's operations center should assume that model no longer protects them. Several European banks run exactly that arrangement with their national telecom incumbent, and at least two have started migrating after seeing this disclosure.
The story is rarely the launch. It is what breaks, what ships, and who owns the mess at 2 a.m.
The router problem is going to get worse
The economics of fiber rollout push service providers toward the cheapest acceptable customer premises equipment, and the cheapest units come from vendors with weak firmware practices and short support windows. A unit sold in 2023 with a five year expected life may have received its last security update in 2024. Multiply that across the hundreds of millions of fiber connections added globally since 2020 and the pool of high-bandwidth, permanently vulnerable endpoints is enormous.
Regulators have started noticing. The European Union's Cyber Resilience Act imposes support obligations on connected devices sold after December 2027, which does nothing for hardware already in homes. The UK's Product Security and Telecommunications Infrastructure regime bans default passwords but has no teeth against a hardcoded service account. Industry groups have proposed a labeling scheme for router security, an idea that has been proposed roughly every three years since 2016 without producing a labeled router anyone can buy.
What the target did right
The bank in question had done the unglamorous work. Its origin addresses were not publicly resolvable, which prevented the attackers from bypassing the edge entirely, a mistake that undoes DDoS protection for a surprising number of organizations. It ran authoritative DNS through a provider with its own anycast capacity rather than a single-region nameserver. It had rate limits configured on authentication endpoints, which mattered because the volumetric burst was accompanied by a credential stuffing campaign that Cloudflare believes was the actual objective.
That last detail deserves emphasis. Volumetric attacks are increasingly cover for something else, either credential stuffing while logging is saturated or a distraction while an intrusion proceeds elsewhere. Incident responders at Mandiant and Unit 42 have both published on the pattern. The correct reaction to a large DDoS is to raise scrutiny on authentication and data egress rather than to declare victory when traffic returns to normal.
Where the record goes next
Cloudflare, Google, and Akamai have traded record disclosures for a decade, and each one arrives with a note that the previous ceiling has been broken by a wide margin. The 12.4 terabit figure will not stand long. Cloudflare's own network capacity sits above 400 terabits per second across 340 cities, so the current attacks remain a small fraction of what the largest providers can absorb. The pressure falls on everyone below that tier.
The uncomfortable trajectory is that DDoS defense has consolidated into three or four companies with enough backbone capacity to matter. That is efficient and it concentrates risk. A national regulator in Europe has begun asking whether critical financial infrastructure depending on a single American mitigation provider constitutes a systemic dependency, a question that has no comfortable answer and that will shape procurement conversations across the continent over the next two years.
Skarvonix will keep following this beat with reporting grounded in how systems behave outside the launch keynote.
- Zero Trust
- Edge Computing
