Loading story…
Qrator Labs reported that the largest botnet it tracks grew from roughly 1.33 million devices in March 2025 to 13.5 million devices in Q1 2026, driving a new wave of massive distributed denial-of-service attacks against financially focused organizations. The firm said FinTech, banks, and payment systems were the most targeted sectors, as attackers increasingly combined L3/L4 and L7 techniques in larger, more complex multi-vector campaigns. It also recorded a rise in bad-bot activity, with an average of 2.5 billion blocked requests per month.
One of the most significant incidents hit the betting industry in mid-March, peaking at 2.065 Tbps and nearly 1 billion packets per second over about 40 minutes, with attackers shifting tactics 11 times during the assault. Qrator linked the broader trend to evolving botnet tradecraft, including a new loader called Aeternum C2 that uses the Polygon blockchain for decentralized command-and-control, and to the continued evolution of large-scale botnet operations previously associated with record-setting campaigns such as Mēris.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Qrator Labs disclosed technical details on a new loader called Aeternum C2 that uses the Polygon blockchain for decentralized command-and-control. The finding highlighted an evolution in botnet resilience and infrastructure design.
Qrator Labs said the largest tracked DDoS botnet expanded to 13.5 million devices in the first quarter of 2026, enabling multi-terabit attacks. The report also noted increased multi-vector activity and financially oriented sectors such as FinTech, banks, and payment systems as leading targets.
In mid-March 2026, Qrator Labs observed a major DDoS attack against a betting-sector organization that peaked at 2.065 Tbps and nearly 1 billion packets per second for about 40 minutes. During the attack, the operators reportedly changed tactics 11 times, indicating a complex multi-vector operation.
Qrator Labs reported that the largest tracked DDoS botnet had a size of about 1.33 million devices in March 2025. This serves as the baseline before the botnet's later rapid expansion.
Qrator Labs published analysis of the Mēris botnet, documenting its rise and record-setting DDoS capabilities. This established the botnet as a major large-scale DDoS threat.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A March multinational operation involving the United States, Canada, and Germany disrupted infrastructure supporting the Aisiru and Kimwolf botnets, contributing to a fall in the largest observed botnet from 13.5 million devices in Q1 2026 to 2.09 million in Q2. Link11 also reported a 42% decline in DDoS attacks in Europe during the first half of 2026, partly attributing the reduction to law-enforcement actions including Operation Eastwood and the shutdown of four IoT botnets. Attackers are compensating with more powerful and resilient campaigns: Link11 recorded peaks of **2.3 Tbit/s** and **322 million packets per second**, with 705 TB of cumulative malicious traffic, driven by super-botnets and hijacked cloud servers. Operators are increasingly dispersing traffic sources and adopting decentralized command infrastructure; the Aeternum and Void botnets use Polygon and Ethereum smart contracts for C2 distribution. DDoS surges are also being used to conceal SQL-injection and XSS probing, requiring defenses that combine continuous traffic inspection, behavioral detection, adaptive filtering, and application-layer monitoring.
Sep 4, 2026In September 2025, Qrator Labs thwarted a major Layer 7 DDoS attack targeting a government organization, leveraging a botnet of 5.76 million compromised IoT devices. The botnet, first observed in March with 1.33 million devices, rapidly expanded to nearly six million by September. The attack was executed in two waves and sourced traffic from multiple countries, with significant growth in India and Vietnam.
Jun 29, 2026
Researchers and network defenders linked the **Aisuru** botnet to a wave of hyper-volumetric distributed denial-of-service attacks that pushed internet-scale flooding to new highs. Reports described attacks reaching **11.5 Tbps** and later **22.2 Tbps** with **10.6 billion packets per second**, with one major incident lasting about 40 seconds and being automatically mitigated by Cloudflare. Coverage from Cloudflare, The Register, Cybersecurity Dive, and QiAnXin XLab said the botnet helped fuel a broader rise in DDoS activity and turned parts of the internet into what one report characterized as a terabit-scale stress test. Government and industry tracking indicated the botnet was not an isolated spike but an active threat affecting organizations across regions, including the UK. Germany's **BSI** published an Aisuru botnet profile as defenders continued cataloging its infrastructure and behavior, while media reports said British businesses were hit by record botnet-driven barrages. Across the referenced reporting, Aisuru emerged as a large-scale botnet associated with compromised devices and capable of launching short, extremely intense floods that set new benchmarks for DDoS volume and forced providers to rely on automated mitigation at massive scale.
Jun 29, 2026