Authorities Disrupt Four IoT Botnets Behind 30 Tbps DDoS Attacks

U.S., Canadian, and German authorities disrupted the command-and-control infrastructure of four major IoT botnets — Aisuru, KimWolf, JackSkid, and Mossad — that collectively compromised more than three million internet-connected devices worldwide. Investigators said the botnets, built largely from vulnerable DVRs, IP cameras, web cameras, and enterprise Wi‑Fi routers, were used in hundreds of thousands of distributed denial-of-service attacks, including operations targeting U.S. Department of Defense systems, other high-value networks, and critical infrastructure. Officials said the malware networks were capable of generating traffic above 30 Tbps, with one attack reaching roughly 31.4 Tbps, placing them among the largest DDoS threats recorded.

The operators allegedly ran the infrastructure as a DDoS-for-hire service and also used it for extortion, threatening victims with sustained attacks unless they paid. The U.S. action, led by the Defense Criminal Investigative Service with support from the FBI Anchorage Field Office, included seizure warrants for domains and virtual servers, while Germany’s BKA and Canada’s RCMP carried out parallel enforcement steps. Private-sector partners including Akamai, AWS, Cloudflare, Team Cymru, and The Shadowserver Foundation supported the disruption. Authorities said the takedown degraded the botnets’ ability to operate, but warned that the underlying risk remains because millions of infected or insecure devices are still online with weak credentials or outdated firmware.