- Aisuru botnet, with up to 4M IoT devices, launched a record 29.7 Tbps DDoS attack
- Cloudflare mitigated 1,304 hypervolumetric attacks in Q3; targets included telecom, gaming, hosting and finance
- Recent victims include Gcore (6 Tbps flood) and Microsoft (largest cloud DDoS at 15.72 Tbps)
The Aisuru botnet, a network of compromised and malicious Internet of Things (IoT) devices, has launched a record-breaking Distributed Denial of Service (DDoS) attack for the third time in as many months.
Earlier this week, Cloudflare released its 2025 Q3 DDoS threat report, which describes an attack from the “top of the botnets”. In the report, the CDN giant said Aisuru counted somewhere between one and four million infected devices and mounted a DDoS attack that peaked at 29.7 terabits per second (Tbps) and 14.1 billion packets per second (Bpps).
Cloudflare described it as a “UDP carpet bombing attack that bombarded an average of 15K destination ports per second”.
Thousands of Aisuru attacks
The distributed attack randomized various packet attributes and attempted to bypass the defenses, but Cloudflare’s mitigation systems managed to autonomously prevent the attack, the report said.
The botnet was also extremely active, averaging 14 hypervolumetric attacks per day, many of which “routinely exceeded” 1 Tbps and 1 Bpps.
Furthermore, there were 54% more attacks in the third quarter of the year compared to the second.
It targeted organizations in various verticals, Cloudflare also said, including telecommunications providers, gaming companies, hosting providers and financial services. The botnet was also used to target US Internet infrastructure, and since it is offered as a service, virtually anyone can easily disrupt critical infrastructure, health services, emergency services, or even the US military.
“Since the start of 2025, Cloudflare has already mitigated 2,867 Aisuru attacks,” the report claims. “In the third quarter alone, Cloudflare mitigated 1,304 hypervolumetric attacks launched by Aisuru.”
In mid-October this year, gaming company Gcore was hit by a “black-burst volumetric flood” that lasted between 30 and 45 seconds and peaked at 6 Tbps with 5.3 billion packets per second, an attack that was later attributed to Aisuru. A month later, Microsoft announced it successfully mitigated “the largest DDoS attack ever observed in the cloud,” which was also attributed to the same botnet.
The attack used more than 500,000 source IPs across different regions and delivered a multi-vector Distributed Denial of Service (DDoS) attack that measured 15.72 Tbps and nearly 3.64 billion packets per second (pps).
Via Bleeping Computer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
