- Aisuru botnet, with up to 4 million IoT devices, launched a record 29.7 Tbps DDoS attack
- Cloudflare mitigated 1,304 hypervolumetric attacks in Q3; targets included telecommunications, gaming, hospitality and finance
- Recent victims include Gcore (6 Tbps flood) and Microsoft (largest cloud DDoS at 15.72 Tbps)
The Aisuru botnet, a network of compromised and malicious Internet of Things (IoT) devices, has launched a record-breaking distributed denial of service (DDoS) attack for the third time in as many months.
Earlier this week, Cloudflare released its Q3 2025 DDoS Threat Report, detailing an attack carried out by “the top of the botnets.” In the report, the CDN giant said Aisuru had between one and four million infected devices and launched a DDoS attack that peaked at 29.7 terabits per second (Tbps) and 14.1 billion packets per second (Bpps).
Cloudflare described it as a “UDP carpet bombing attack bombing an average of 15,000 destination ports per second.”
Thousands of attacks from Aisuru
The distributed attack randomized various packet attributes, attempting to bypass defenses, but Cloudflare’s mitigation systems were able to autonomously prevent the attack, the report said.
The botnet was also extremely active, averaging 14 hyper-volumetric attacks per day, many of which “regularly exceeded” 1 Tbps and 1 Bpps.
Additionally, there were 54% more attacks in the third quarter of the year compared to the second.
It targeted organizations across different industries, Cloudflare also said, including telecommunications providers, gaming companies, hosting providers and financial services. The botnet has also been used to target US internet infrastructure, and because it is offered as a service, virtually anyone can easily disrupt critical infrastructure, healthcare, emergency services, or even the US military.
“Since the start of 2025, Cloudflare has already mitigated 2,867 Aisuru attacks,” the report states. “In the third quarter alone, Cloudflare mitigated 1,304 hyper-volumetric attacks launched by Aisuru.
In mid-October this year, gaming company Gcore was hit by a “short-lived volumetric flood” lasting between 30 and 45 seconds and peaking at 6 Tbps with 5.3 billion packets per second, an attack that was later attributed to Aisuru. A month later, Microsoft announced that it had successfully mitigated “the largest DDoS attack ever observed in the cloud”, also attributed to the same botnet.
The attack used over 500,000 source IP addresses, across various regions, delivering a multi-vector distributed denial of service (DDoS) attack measuring 15.72 Tbps and nearly 3.64 billion packets per second (pps).
Via BeepComputer
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
