Loading malware…
Aisuru is a Mirai-derived botnet used for high-volume distributed denial-of-service attacks and traffic proxying. It compromises internet-connected routers, gateways, cameras, DVRs, and other IoT devices through firmware vulnerabilities. Its operators also exploit exposed Android Debug Bridge services to install Android payloads that convert compromised devices into TCP and UDP proxy relays.
Aisuru primarily generates direct volumetric UDP and TCP floods. Observed operations commonly use 60-second attack commands, which operators chain into longer attack sessions. Targets span technology, finance, education, government, and other sectors worldwide. Its command interface supports configurable targets, ports, packet sizes, timing, payloads, and TCP options. The malware also contains a backconnect proxy capability that operators have used to scan local addresses for accessible Android debugging services and deliver additional proxyware.
Aisuru conceals command-and-control information in DNS TXT records using Base64 and XOR encoding. Bots establish TCP connections and exchange an RC4-wrapped ChaCha20 key and nonce before communicating using ChaCha20 encryption. Shared distribution scripts, APK signing certificates, payloads, and infrastructure connect Aisuru to the Android-focused Kimwolf botnet and support attribution to the same operator ecosystem.
A coordinated United States, German, and Canadian law-enforcement operation disrupted Aisuru command-and-control infrastructure in March 2026. Observed attack activity stopped temporarily before resuming at a reduced rate, followed by infrastructure changes and expanded proxy-network recruitment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
„Најраниот пронајден примерок, кој ја таргетира x86 архитектурата со експлоатација на Dirty COW , укажува дека оваа фамилија еволуирала од традиционална Linux експлоатација кон актуелниот Android модел на ширење базиран на ADB“
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“These two major botnets propagated through the same infection scripts between September and November, coexisting in the same batch of devices. They actually belong to the same hacker group.”
Shared infrastructure ties the operator to the Keksec ecosystem, home to Kaitori and AISURU tooling.
Microsoft disclosed that it automatically detected and neutralized a distributed denial-of-service (DDoS) attack targeting a single endpoint in Australia that measured 15.72 terabits per second (Tbps)... It originated from a TurboMirai-class Internet of Things (IoT) botnet known as AISURU. According to data from QiAnXin XLab, the AISURU botnet is powered by nearly 300,000 infected devices, most of which are routers, security cameras, and DVR systems.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Атакующий собирает IP-адреса целевой инфраструктуры - IP Addresses (T1590.005, Reconnaissance).
...и формирует или арендует ботнет - Botnet (T1583.005, Resource Development).
Под контроль операторов попадали Android-приставки, стриминговые устройства, веб-камеры, цифровые фоторамки и другая IoT-техника... Владельцы ботнета продавали доступ к зараженным устройствам другим злоумышленникам по модели cybercrime-as-a-service.
The botnet typically abuses residential proxy services to reach Android TVs that ship with Android Debug Bridge (ADB) enabled on port 5555 on local networks and install malware capable of conducting DDoS attacks and acting as a relay to ferry malicious traffic.
Bitsight TRACE documented 72.56.52.158 as an "ADB exploitation payload host (port 8002)" and proxybot C2 in an ENS record; ML Cloud's geofeed listed 72.56.52.0/24 as a Riga location.
“pm list packages | grep a.b.c”; “pm install /sdcard/f.apk”; and “am startservice -n a.b.c/.SDKService.”
The botnet typically abuses residential proxy services to reach Android TVs that ship with Android Debug Bridge (ADB) enabled on port 5555 on local networks and install malware capable of conducting DDoS attacks and acting as a relay to ferry malicious traffic.
“TXT records with base64 and XOR encoded information” and “Recreation of the obfuscated code used to deploy the proxybot ELF file.”
Rather than fire raw packets, this latest Kimwolf version operates with full browser fingerprints, copying the header order and behavior of the Chrome web browser.
The bot agent brute-forces Telnet access on targeted devices with 1,496 credential pairs... The Telnet, SSH, HTTP and Android Debug Bridge (ADB) scanners all operate correctly.
“the bot masters started executing a local network scan through the proxy command” and “Kimwolf has been scanning local networks at least since the 5th of June.”
Explore Bitsight TRACE research into Aisuru’s DDoS operations, C2 infrastructure, ADB exploitation, and evolution toward a new proxy network.
Additionally, if all five addresses fail, the botnet falls back to a fixed Tor hidden service address written into the code.
The biggest change, according to the report, is a new flood method built on HTTP/2, the protocol that carries most web traffic today.
“The bot first resolves its C2 from a DNS TXT dead-drop” and “dead drop domains ... update information in their TXT records with base64 and XOR encoded information to give the real backend IPs back to the bot.”
Published third-party research places malware infrastructure in SYSECT-routed prefixes: Kimwolf v7 C2 endpoints in 212.193.31.0/24; an Aisuru-matched sample contacting 147.45.44.34:8001; and a possible Sliver C2 at 89.19.220.70:4443. Bitsight also documented Aisuru/Kimwolf proxy infrastructure in ML Cloud-geofeed-declared ranges.
Tor resolves that address through its own network rather than the ordinary domain system, and it hides where the server actually sits, which leaves investigators without a host to contact.
“This payload opens a raw netcat communication with the IP presented and downloads an APK that is then installed and initiated on the system.”
The malware now looks up its command address in the Ethereum Name Service, a directory that lives on the Ethereum blockchain.
“Behind the domains we counted 259 distinct C2 IPs” and “the operators kept trying to stand up replacements.”
“the bot masters rotate infrastructure ... through dead drop domains that will update information in their TXT records” and “a DGA-style ndse... [domain].”
“The C2 answers with a KEYEXCHANGE ... carrying an RC4-wrapped ChaCha20 key and nonce, and from that point on every message is ChaCha20-encrypted.”
generic malware, such as botnets, is increasingly targeting OT devices... exploit OT default credentials and wipe data directories
“the ATTACK command (which instructs the bot to carry out a DDoS attack)” and “Over four months of tracking we logged 66,596 DDoS attack commands.”
“Aisuru is overwhelmingly a volumetric brute-force botnet: UDP floods make up ~55% of commands and TCP floods about ~44% (PSH+ACK, SYN, ACK, connection).”
These attackers exploit well-known credentials and attempt to wipe data, spread malware or launch DDoS attacks
137 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
191 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A DDoS and proxyware botnet mentioned as background because infrastructure previously associated with it uses another subdomain of proxystream[.]st. The content does not establish that AISURU participated in the Plex2Shell attacks.
DDoS and proxyware botnet mentioned as background because infrastructure previously linked to it shares a parent domain with the mining server used in the Plex compromises. The article does not establish that AISURU participated in these attacks.
Botnet explicitly associated with the myawesomeproxy residential proxy payload. The content provides no further technical description of Aisuru or evidence that Aisuru itself exploits the Plex vulnerabilities.
DDoS botnet associated with operators contributing to the reported surge in attacks exceeding 1 Tbps or 1 Gpps during the first half of 2026. The content provides no family-specific technical details.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.