- Aisuru botnet, with up to 4 million IoT devices, launched a record 29.7 Tbps DDoS attack
- Cloudflare mitigated 1,304 hypervolumetric attacks in Q3; Targets included telecommunications, gaming, hosting and finance.
- Recent victims include Gcore (6 Tbps flood) and Microsoft (largest cloud DDoS at 15.72 Tbps)
The Aisuru botnet, a network of compromised and malicious Internet of Things (IoT) devices, has mounted a record-breaking distributed denial of service (DDoS) attack for the third time in as many months.
Earlier this week, Cloudflare released its Q3 2025 DDoS threat report, detailing an attack from “the pinnacle of botnets.” In the report, the CDN giant said that Aisuru counted between one and four million infected devices, and that it mounted a DDoS attack that peaked at 29.7 terabits per second (Tbps) and 14.1 billion packets per second (Bpps).
Cloudflare described it as a “UDP bombing attack that bombards an average of 15,000 target ports per second.”
Thousands of attacks on Aisuru
The distributed attack randomized various packet attributes, attempting to bypass defenses, but Cloudflare’s mitigation systems managed to prevent the attack autonomously, the report said.
The botnet was also extremely active, averaging 14 hypervolumetric attacks daily, many of which “routinely exceeded” 1 Tbps and 1 Bpps.
In addition, there were 54% more attacks in the third quarter of the year, compared to the second.
Cloudflare also stated that it was targeting organizations in different verticals, including telecommunications providers, gaming companies, hosting providers, and financial services. The botnet was also used to attack US Internet infrastructure, and since it is offered as a service, virtually anyone can easily disrupt critical infrastructure, healthcare services, emergency services, or even the US military.
“Since the beginning of 2025, Cloudflare has already mitigated 2,867 Aisuru attacks,” the report states. “In the third quarter alone, Cloudflare mitigated 1,304 hypervolumetric attacks launched by Aisuru.”
In mid-October this year, gaming company Gcore suffered a “short burst volumetric flood” that lasted between 30 and 45 seconds and peaked at 6 Tbps with 5.3 billion packets per second, an attack later attributed to Aisuru. A month later, Microsoft announced that it had successfully mitigated “the largest DDoS attack ever observed in the cloud,” which was also attributed to the same botnet.
The attack used over 500,000 source IPs, across multiple regions, delivering a multi-vector distributed denial of service (DDoS) attack that measured 15.72 Tbps and nearly 3.64 billion packets per second (pps).
Through beepcomputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
