Loading story…
Researchers linked the AIRASHI botnet to large-scale distributed denial-of-service attacks against Steam and Perfect World during the release period of Black Myth: Wukong, describing a Mirai-derived operation that evolved from AISURU and kitty into a globally distributed platform capable of sustained 1–3 Tbps floods. The operators allegedly showcased attack tests on Telegram, including a cited peak of 3.11 Tbps and 270.52 Mpps, while targeting organizations across multiple countries and sectors. AIRASHI was reported to use broad infection methods, including known vulnerabilities, Telnet weak passwords, and an actively exploited zero-day in Cambium Networks cnPilot routers.
Technical analysis showed the botnet had matured significantly, with RC4-obfuscated strings, DNS TXT-based command-and-control retrieval, and a newer C2 protocol using HMAC-SHA256 and ChaCha20. Researchers identified multiple malware families tied to the operation, including AIRASHI-DDoS, AIRASHI-Proxy, and Go-Proxisdk, with some variants supporting proxy functions and others focused on DDoS activity. The reporting also published infrastructure details such as C2 domains, downloader IPs, file hashes, and a Snort detection rule to help defenders identify exploitation attempts and infections tied to the cnPilot router compromise.
See which actors are running it and whether you're in range.
20 events from the most recent confirmed update back to the earliest known activity.
Steam, Riot Games, and PlayStation Network experienced major disruptions on October 6-7, 2025. The outages were real, but no official source confirmed they were caused by DDoS, and the widely shared 29.69 Tbps claim remained unverified.
Cloudflare confirmed a 22.2 Tbps DDoS attack on a European network infrastructure company that peaked at 10.6 billion packets per second and lasted about 40 seconds. Cloudflare and XLab assessed Aisuru was likely involved, though attribution was not definitive.
Cloudflare confirmed an 11.5 Tbps DDoS attack in early September 2025 against an undisclosed customer, and XLab definitively attributed that attack to the Aisuru botnet.
The Aisuru botnet reportedly grew sharply after a Totolink router firmware supply-chain compromise involving the update domain updatetoto[.]tw and a malicious script named t.sh. The assessment says the botnet expanded from fewer than 100,000 nodes to more than 300,000 after this event.
The botnet operators allegedly posted a DDoS capability test result on Telegram showing a peak of 3.11 Tbps and 270.52 Mpps.
XLab reported first observing the AIRASHI-Proxy sample class in early December 2024 as a modified AIRASHI codebase implementing proxy functionality with a private protocol.
XLab first observed the Go-Proxisdk sample family in late November 2024 and described it as a Go-based proxy tool built on muxado.
A new botnet variant appeared in late November 2024 and was renamed AIRASHI, continuing the AISURU lineage under a new identity.
By late October 2024, kitty had shifted to using SOCKS5 proxies for command-and-control communications and embedded large proxy and C2 lists in its string table.
XLab reported first seeing the AIRASHI-DDoS sample class in late October 2024. This family supported DDoS attacks, arbitrary command execution, and reverse shell functionality.
The AISURU botnet resurfaced in October 2024 as a new variant named kitty, which began spreading in early October.
After the August 2024 incident was exposed, the AISURU botnet temporarily ceased activity in September 2024.
XLab observed a planned large-scale DDoS campaign in August 2024 targeting Steam and Perfect World during the release period of Black Myth: Wukong. The attacks hit hundreds of servers across 13 global regions in multiple waves timed for peak gaming activity.
Researchers said they contacted Cambium Networks in June 2024 regarding the cnPilot router zero-day but received no response.
XLab reported that the botnet operators had been exploiting an undisclosed zero-day vulnerability in Cambium Networks cnPilot routers since June 2024 to spread infections.
LILIN released updated firmware version 2.0b60_20200207 to remediate the DVR vulnerabilities, including hostname validation and fixes for the arbitrary file-read issue.
360Netlab provided LILIN with proof-of-concept details for the in-the-wild FTP and NTP vulnerability paths used in exploitation.
LILIN responded to 360Netlab after a second outreach attempt concerning the DVR zero-day issues affecting its devices.
360Netlab contacted LILIN regarding the in-the-wild DVR zero-day vulnerabilities and initially received no response from the vendor.
360Netlab observed multiple attacker groups exploiting a LILIN DVR zero-day vulnerability chain to distribute IoT botnets, including Chalubo, FBot, and Moobot. The activity marked a shift from common N-day exploitation to active use of a 0-day for propagation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 71 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
gist.github.com
Open sourceblog.apnic.net
Open sourceblog.xlab.qianxin.com
Open sourceblog.netlab.360.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Aisuru botnet, a Mirai-based IoT malware network, has been responsible for a series of unprecedented distributed denial-of-service (DDoS) attacks, with some exceeding 20 terabits per second and 4 gigapackets per second. These attacks have primarily targeted online gaming platforms and have caused significant disruptions for broadband providers, with infected consumer routers, CCTV/DVRs, and other vulnerable devices being leveraged to generate massive traffic floods. The botnet's operators have avoided government and military targets, focusing instead on commercial and consumer-facing services, and have demonstrated the ability to overwhelm network infrastructure, including causing router line card failures at ISPs. In addition to its DDoS capabilities, Aisuru has recently shifted towards monetizing its vast network of compromised devices by renting them out as residential proxies. This move has enabled cybercriminals to anonymize their traffic, facilitating large-scale data harvesting and content scraping operations, often tied to artificial intelligence projects. The proliferation of Aisuru-controlled proxies has made it easier for malicious actors to evade detection by routing their activities through what appear to be legitimate residential connections, further complicating mitigation efforts for ISPs and targeted organizations.
Jun 29, 2026
Researchers reported multiple fast-moving IoT/Linux botnet campaigns built from **Mirai** and **Gafgyt** code that aggressively targeted embedded devices through known vulnerabilities and, in some cases, credential brute forcing. Palo Alto Networks said the campaigns—linked to evolutions of **Omni**, **Okane**, and **Hakai**—combined as many as 11 exploits in a single sample and introduced new distributed denial-of-service techniques, while related **Gafgyt** malware added an `HTTPCF` Layer 7 attack command aimed at Cloudflare-protected URLs. One newly adopted vector was the unauthenticated remote command execution flaw in **D-Link DSL-2750B** routers, which attackers incorporated shortly after public exploit tooling became available. The activity mirrors earlier reporting on **IoT_reaper**, a rapidly spreading botnet that also favored exploit-driven propagation over Mirai-style weak-password attacks. Netlab 360 said Reaper integrated at least nine exploits across products from **D-Link, Netgear, Linksys, AVTECH, GoAhead, JAWS,** and **Vacron**, maintained multiple command-and-control components, and at one point showed more than 10,000 daily active bot IPs on a tracked server, with millions of vulnerable devices queued for infection. Together, the reports show botnet operators quickly weaponizing public disclosures and modules to compromise internet-exposed routers and cameras at scale, then repurposing those infections for DDoS and broader botnet operations.
Aug 15, 2026
Researchers and network defenders linked the **Aisuru** botnet to a wave of hyper-volumetric distributed denial-of-service attacks that pushed internet-scale flooding to new highs. Reports described attacks reaching **11.5 Tbps** and later **22.2 Tbps** with **10.6 billion packets per second**, with one major incident lasting about 40 seconds and being automatically mitigated by Cloudflare. Coverage from Cloudflare, The Register, Cybersecurity Dive, and QiAnXin XLab said the botnet helped fuel a broader rise in DDoS activity and turned parts of the internet into what one report characterized as a terabit-scale stress test. Government and industry tracking indicated the botnet was not an isolated spike but an active threat affecting organizations across regions, including the UK. Germany's **BSI** published an Aisuru botnet profile as defenders continued cataloging its infrastructure and behavior, while media reports said British businesses were hit by record botnet-driven barrages. Across the referenced reporting, Aisuru emerged as a large-scale botnet associated with compromised devices and capable of launching short, extremely intense floods that set new benchmarks for DDoS volume and forced providers to rely on automated mitigation at massive scale.
Jun 29, 2026