Loading story…
Cloudflare reported mitigating a record-breaking hyper-volumetric DDoS campaign attributed to the Aisuru/Kimwolf botnet, with a peak of 31.4 Tbps and application-layer floods exceeding 200 million HTTP requests per second. Cloudflare said the activity—named “The Night Before Christmas” due to its timing—began on December 19, 2025 and targeted both Cloudflare customers and Cloudflare’s own dashboard/infrastructure, with many victims described as telecommunications providers and IT organizations.
Reporting on Cloudflare’s findings indicates the campaign consisted of thousands of individual attacks that were typically short in duration (often 1–2 minutes), with the majority peaking in the 1–5 Tbps range and 1–5 billion packets per second. The botnet was also linked to prior record-setting activity (including a previously disclosed 29.7 Tbps peak), and Cloudflare attributed the attack sources in this campaign primarily to compromised Android TV/streaming devices; Cloudflare stated the attacks were automatically detected and mitigated without triggering internal alerts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On January 29, 2026, multiple outlets reported Cloudflare's disclosure of the December Aisuru/Kimwolf campaign, including details that the botnet relied heavily on compromised Android TV and other consumer devices.
Cloudflare's year-end reporting said it mitigated 47.1 million DDoS attacks in 2025, a 121% increase over 2024, with continued growth in Q4 and sharp increases in terabit-scale and high packet-rate attacks.
During the December 19 campaign, Cloudflare mitigated a publicly disclosed record DDoS event peaking at 31.4 Tbps and more than 200 million HTTP requests per second, attributing it to the Aisuru/Kimwolf botnet and saying mitigation was fully automated.
Beginning on December 19, 2025, the Aisuru/Kimwolf botnet launched a hyper-volumetric DDoS campaign targeting Cloudflare customers, Cloudflare infrastructure, and its dashboard, with attacks delivered in short, intense bursts.
In its 2025 Q3 DDoS threat reporting, cited by ZDNET, Cloudflare characterized Aisuru as the 'apex of botnets' and noted its frequent targeting of telecommunications, gaming, hosting, ISP, and financial services organizations.
Barracuda reported Kimwolf as active since 2025, portraying it as a stealthy botnet that embeds in enterprise and public-sector environments and uses dynamic communications to evade detection.
Barracuda described Aisuru as active since 2024, using automated scanning and exploitation to rapidly compromise vulnerable IoT devices and build a botnet capable of large volumetric DDoS attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcetomshardware.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceblog.barracuda.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare reported mitigating a **record-setting hyper-volumetric DDoS attack** attributed to the **AISURU/Kimwolf** botnet that peaked at **31.4 Tbps** and lasted **35 seconds** in **November 2025**. The activity was described as part of a broader late-2025 surge in hyper-volumetric HTTP DDoS events that Cloudflare said were automatically detected and blocked, with **Q4 2025** hyper-volumetric attacks increasing **40%** quarter-over-quarter and the largest attacks growing **700%** compared to late 2024. Reporting tied AISURU/Kimwolf to DDoS-for-hire style operations and additional campaigns such as **“The Night Before Christmas”** (starting **December 19, 2025**), with Cloudflare citing campaign averages around **3 Bpps**, **4 Tbps**, and **54 Mrps**, and peaks up to **9 Bpps**, **24 Tbps**, and **205 Mrps**. The botnet’s capabilities and impact extend beyond web-layer floods: it has been associated with UDP/TCP/GRE flooding techniques and disruption of broadband providers via traffic sourced from compromised customer devices/CPE, and it has been described as enabling other illicit activity (e.g., credential stuffing, scraping, spam, phishing); separate reporting also stated the botnet has leveraged a large pool of compromised devices, including **millions of Android-based endpoints** such as off-brand Android TVs.
Jun 29, 2026
Cloudflare successfully detected and mitigated the largest distributed denial-of-service (DDoS) attack on record, which peaked at 29.7 terabits per second and was attributed to the AISURU botnet. The attack, which lasted 69 seconds, utilized UDP carpet-bombing techniques targeting an average of 15,000 destination ports per second, and originated from a botnet-for-hire service leveraging between one and four million compromised routers and IoT devices worldwide. While the specific target of the attack was not disclosed, Cloudflare noted that the AISURU botnet has been responsible for a surge in hyper-volumetric DDoS attacks, particularly against telecommunications, gaming, hosting, and financial services sectors. AISURU's operations have resulted in over 2,800 attacks mitigated by Cloudflare since the start of the year, with nearly half classified as hyper-volumetric, exceeding 1 Tbps or 1 billion packets per second. The botnet's activity has not only set new records for DDoS attack volume but has also demonstrated the potential to disrupt internet service providers even when they are not the direct targets. The majority of attack sources have been traced to locations in Asia, and the overall frequency and scale of DDoS attacks have seen significant increases compared to previous quarters and years.
Jun 29, 2026
Researchers and network defenders linked the **Aisuru** botnet to a wave of hyper-volumetric distributed denial-of-service attacks that pushed internet-scale flooding to new highs. Reports described attacks reaching **11.5 Tbps** and later **22.2 Tbps** with **10.6 billion packets per second**, with one major incident lasting about 40 seconds and being automatically mitigated by Cloudflare. Coverage from Cloudflare, The Register, Cybersecurity Dive, and QiAnXin XLab said the botnet helped fuel a broader rise in DDoS activity and turned parts of the internet into what one report characterized as a terabit-scale stress test. Government and industry tracking indicated the botnet was not an isolated spike but an active threat affecting organizations across regions, including the UK. Germany's **BSI** published an Aisuru botnet profile as defenders continued cataloging its infrastructure and behavior, while media reports said British businesses were hit by record botnet-driven barrages. Across the referenced reporting, Aisuru emerged as a large-scale botnet associated with compromised devices and capable of launching short, extremely intense floods that set new benchmarks for DDoS volume and forced providers to rely on automated mitigation at massive scale.
Jun 29, 2026