AISURU/Kimwolf Botnet’s Record 31.4 Tbps Hyper-Volumetric DDoS Attack Mitigated by Cloudflare

Cloudflare reported mitigating a record-setting hyper-volumetric DDoS attack attributed to the AISURU/Kimwolf botnet that peaked at 31.4 Tbps and lasted 35 seconds in November 2025. The activity was described as part of a broader late-2025 surge in hyper-volumetric HTTP DDoS events that Cloudflare said were automatically detected and blocked, with Q4 2025 hyper-volumetric attacks increasing 40% quarter-over-quarter and the largest attacks growing 700% compared to late 2024.

Reporting tied AISURU/Kimwolf to DDoS-for-hire style operations and additional campaigns such as “The Night Before Christmas” (starting December 19, 2025), with Cloudflare citing campaign averages around 3 Bpps, 4 Tbps, and 54 Mrps, and peaks up to 9 Bpps, 24 Tbps, and 205 Mrps. The botnet’s capabilities and impact extend beyond web-layer floods: it has been associated with UDP/TCP/GRE flooding techniques and disruption of broadband providers via traffic sourced from compromised customer devices/CPE, and it has been described as enabling other illicit activity (e.g., credential stuffing, scraping, spam, phishing); separate reporting also stated the botnet has leveraged a large pool of compromised devices, including millions of Android-based endpoints such as off-brand Android TVs.