Aisuru/Kimwolf Botnet Sets 31.4 Tbps DDoS Record Against Cloudflare-Protected Targets

Cloudflare reported mitigating a record-breaking hyper-volumetric DDoS campaign attributed to the Aisuru/Kimwolf botnet, with a peak of 31.4 Tbps and application-layer floods exceeding 200 million HTTP requests per second. Cloudflare said the activity—named “The Night Before Christmas” due to its timing—began on December 19, 2025 and targeted both Cloudflare customers and Cloudflare’s own dashboard/infrastructure, with many victims described as telecommunications providers and IT organizations.

Reporting on Cloudflare’s findings indicates the campaign consisted of thousands of individual attacks that were typically short in duration (often 1–2 minutes), with the majority peaking in the 1–5 Tbps range and 1–5 billion packets per second. The botnet was also linked to prior record-setting activity (including a previously disclosed 29.7 Tbps peak), and Cloudflare attributed the attack sources in this campaign primarily to compromised Android TV/streaming devices; Cloudflare stated the attacks were automatically detected and mitigated without triggering internal alerts.