Loading story…
Microsoft Azure was targeted by a massive Distributed Denial of Service (DDoS) attack peaking at 15.72 terabits per second (Tbps) and nearly 3.64 billion packets per second (Bpps), making it the largest cloud DDoS attack ever recorded. The attack, which occurred on October 24, 2025, was launched from over 500,000 IP addresses and targeted a single public endpoint in Australia. The Aisuru botnet, a Turbo Mirai-class IoT botnet, was responsible for the attack, leveraging compromised home routers, cameras, and other IoT devices, primarily from residential ISPs in the United States and other countries. Azure’s global DDoS protection network successfully detected and mitigated the attack, ensuring service continuity.
The Aisuru botnet has rapidly grown in scale, reportedly ballooning in April 2025 after breaching a TotoLink router firmware update server and infecting approximately 100,000 devices. The botnet exploits vulnerabilities in a range of devices, including IP cameras, DVRs/NVRs, and routers from vendors such as T-Mobile, Zyxel, D-Link, and Linksys. Security researchers and Microsoft have highlighted the increasing threat posed by such IoT-based botnets, as faster home internet connections and more powerful devices enable attackers to launch ever-larger DDoS attacks. The incident underscores the need for robust DDoS protection for all internet-facing applications and workloads, especially as attack sizes continue to escalate.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft publicly reported that it successfully mitigated the record-breaking Azure DDoS attack and shared key technical details about its scale, packet rate, and botnet attribution. Multiple outlets covered the same disclosure as the public revelation of the incident.
Microsoft Azure was targeted by a massive distributed denial-of-service attack attributed to the AISURU botnet, reaching roughly 15.7 Tbps and about 3.64 billion packets per second. Reports say the attack traffic came from approximately 500,000 IP addresses, making it the largest cloud DDoS event publicly reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcethehackernews.com
Open sourcetechrepublic.com
Open sourcego.theregister.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Aisuru botnet, now recognized as the world’s largest and most disruptive DDoS botnet, has escalated its operations by leveraging a vast network of compromised Internet-of-Things (IoT) devices, particularly those hosted on major US Internet providers such as AT&T, Comcast, and Verizon. Security experts have observed that the concentration of infected devices within these US-based ISPs is complicating mitigation efforts and increasing the risk of collateral damage during attacks. In recent months, Aisuru has demonstrated its dominance over other IoT-based botnets, with its arsenal estimated at 300,000 compromised hosts globally, including consumer-grade routers, security cameras, and digital video recorders running outdated firmware or default settings. The botnet’s operators continuously scan for vulnerable devices, conscripting them into their network to launch distributed denial-of-service (DDoS) attacks of unprecedented scale. Aisuru’s attack capabilities have grown rapidly, with a notable incident in May 2025 where KrebsOnSecurity was targeted with a 6.35 Tbps DDoS attack, then the largest ever mitigated by Google’s Project Shield. This record was quickly surpassed days later when Aisuru unleashed an 11 Tbps assault. By late September, the botnet was observed flexing its power with attacks exceeding 22 Tbps, culminating in a staggering 29.6 Tbps traffic flood on October 6, 2025. This latest demonstration, though brief and directed at a server designed to measure such events, shattered previous DDoS records and highlighted the botnet’s potential for catastrophic disruption. The technical sophistication of these attacks is not limited to sheer bandwidth. Recent case studies reveal that Aisuru and similar botnets are employing complex, multi-vector strategies. For example, a major US technology company was recently hit by two massive network-layer DDoS attacks in a single day, with the first peaking at 1.2 Tbps and 563 million packets per second (PPS), and the second reaching nearly 1.5 Tbps and sustaining over 1 billion PPS for 20 minutes. These attacks targeted Layers 3 and 4 of the OSI model, using high PPS rates to overwhelm not just bandwidth but also the routing and switching infrastructure of the victim. The attackers utilized UDP-driven floods and, in subsequent waves, introduced TCP components to increase complexity and resource exhaustion. Amplification techniques, exploiting misconfigured services, were also employed to magnify the impact. The globally distributed nature of the botnet, with compromised devices spanning multiple regions, has made it difficult for defenders to block malicious traffic without affecting legitimate users. The attacks have underscored the limitations of relying solely on raw network capacity for DDoS defense. Instead, effective mitigation now requires distributed defense architectures, rapid time-to-mitigation, high-quality traffic scrubbing, and resilience against both volumetric and packet-intensive floods. The evolving tactics of the Aisuru botnet demonstrate a deliberate escalation in both scale and sophistication, posing a significant threat to ISPs, enterprises, and the broader Internet infrastructure. Security teams are urged to reassess their DDoS defense strategies in light of these developments, as traditional approaches may no longer suffice against the scale and complexity of modern botnet-driven attacks.
Jun 29, 2026
Researchers and network defenders linked the **Aisuru** botnet to a wave of hyper-volumetric distributed denial-of-service attacks that pushed internet-scale flooding to new highs. Reports described attacks reaching **11.5 Tbps** and later **22.2 Tbps** with **10.6 billion packets per second**, with one major incident lasting about 40 seconds and being automatically mitigated by Cloudflare. Coverage from Cloudflare, The Register, Cybersecurity Dive, and QiAnXin XLab said the botnet helped fuel a broader rise in DDoS activity and turned parts of the internet into what one report characterized as a terabit-scale stress test. Government and industry tracking indicated the botnet was not an isolated spike but an active threat affecting organizations across regions, including the UK. Germany's **BSI** published an Aisuru botnet profile as defenders continued cataloging its infrastructure and behavior, while media reports said British businesses were hit by record botnet-driven barrages. Across the referenced reporting, Aisuru emerged as a large-scale botnet associated with compromised devices and capable of launching short, extremely intense floods that set new benchmarks for DDoS volume and forced providers to rely on automated mitigation at massive scale.
Jun 29, 2026
Cloudflare successfully detected and mitigated the largest distributed denial-of-service (DDoS) attack on record, which peaked at 29.7 terabits per second and was attributed to the AISURU botnet. The attack, which lasted 69 seconds, utilized UDP carpet-bombing techniques targeting an average of 15,000 destination ports per second, and originated from a botnet-for-hire service leveraging between one and four million compromised routers and IoT devices worldwide. While the specific target of the attack was not disclosed, Cloudflare noted that the AISURU botnet has been responsible for a surge in hyper-volumetric DDoS attacks, particularly against telecommunications, gaming, hosting, and financial services sectors. AISURU's operations have resulted in over 2,800 attacks mitigated by Cloudflare since the start of the year, with nearly half classified as hyper-volumetric, exceeding 1 Tbps or 1 billion packets per second. The botnet's activity has not only set new records for DDoS attack volume but has also demonstrated the potential to disrupt internet service providers even when they are not the direct targets. The majority of attack sources have been traced to locations in Asia, and the overall frequency and scale of DDoS attacks have seen significant increases compared to previous quarters and years.
Jun 29, 2026