Loading story…
A March multinational operation involving the United States, Canada, and Germany disrupted infrastructure supporting the Aisiru and Kimwolf botnets, contributing to a fall in the largest observed botnet from 13.5 million devices in Q1 2026 to 2.09 million in Q2. Link11 also reported a 42% decline in DDoS attacks in Europe during the first half of 2026, partly attributing the reduction to law-enforcement actions including Operation Eastwood and the shutdown of four IoT botnets.
Attackers are compensating with more powerful and resilient campaigns: Link11 recorded peaks of 2.3 Tbit/s and 322 million packets per second, with 705 TB of cumulative malicious traffic, driven by super-botnets and hijacked cloud servers. Operators are increasingly dispersing traffic sources and adopting decentralized command infrastructure; the Aeternum and Void botnets use Polygon and Ethereum smart contracts for C2 distribution. DDoS surges are also being used to conceal SQL-injection and XSS probing, requiring defenses that combine continuous traffic inspection, behavioral detection, adaptive filtering, and application-layer monitoring.
Pull IOCs and campaign context straight into your stack.
12 events from the most recent confirmed update back to the earliest known activity.
Authorities in the United States, Canada, and Germany conducted a coordinated operation that disrupted command-and-control infrastructure for major IoT botnets. The sources identify Aisiru/Kimwolf infrastructure among the targets and report that four disrupted botnets collectively controlled more than three million devices.
In the second quarter of 2026, the top three countries accounted for 32% of application-layer DDoS sources and the top 20 accounted for 70%, down from 47% and about 76% respectively a year earlier. This reduced the effectiveness of country-based filtering as a standalone control.
The largest observed botnet declined to 2.09 million devices in the second quarter of 2026. The decline was assessed as likely influenced by the March multinational disruption, alongside possible remediation and device replacement activity.
During the first half of 2026, Link11 found that 56% of organizations hit by a DDoS attack experienced a second attack within 30 days, up from 46% a year earlier.
Link11 documented attackers using a DDoS traffic spike against two domains as cover for SQL-injection and cross-site-scripting probing. The attackers reused the same IP addresses for the volumetric traffic and the application-layer probes.
During the first half of 2026, Link11 recorded a 2.3 Tbit/s peak DDoS attack, 322 million packets per second, and 705 TB of cumulative attack traffic. It attributed the increased force in part to super-botnets and hijacked cloud servers, despite a 42% decline in attack counts.
The largest observed botnet reached 13.5 million devices during the first quarter of 2026, following rapid growth from prior years.
Operation Eastwood disrupted infrastructure used by the pro-Russian NoName057(16) group.
The largest observed botnet grew to 5.76 million compromised devices in 2025.
The largest observed botnet size increased to 228,000 devices in 2024.
The largest observed botnet size was 136,000 compromised devices in 2023.
Aeternum was identified as using Polygon smart contracts and Void as using Ethereum smart contracts for command-and-control instructions or infrastructure pointers. This decentralized approach reduces reliance on C2 servers that authorities can seize or take offline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcesecuritysenses.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Qrator Labs reported that the largest botnet it tracks grew from roughly **1.33 million** devices in March 2025 to **13.5 million** devices in Q1 2026, driving a new wave of massive distributed denial-of-service attacks against financially focused organizations. The firm said **FinTech, banks, and payment systems** were the most targeted sectors, as attackers increasingly combined **L3/L4** and **L7** techniques in larger, more complex multi-vector campaigns. It also recorded a rise in bad-bot activity, with an average of **2.5 billion blocked requests per month**. One of the most significant incidents hit the betting industry in mid-March, peaking at **2.065 Tbps** and nearly **1 billion packets per second** over about **40 minutes**, with attackers shifting tactics **11 times** during the assault. Qrator linked the broader trend to evolving botnet tradecraft, including a new loader called **Aeternum C2** that uses the **Polygon** blockchain for decentralized command-and-control, and to the continued evolution of large-scale botnet operations previously associated with record-setting campaigns such as **Mēris**.
Jun 29, 2026
Researchers and network defenders linked the **Aisuru** botnet to a wave of hyper-volumetric distributed denial-of-service attacks that pushed internet-scale flooding to new highs. Reports described attacks reaching **11.5 Tbps** and later **22.2 Tbps** with **10.6 billion packets per second**, with one major incident lasting about 40 seconds and being automatically mitigated by Cloudflare. Coverage from Cloudflare, The Register, Cybersecurity Dive, and QiAnXin XLab said the botnet helped fuel a broader rise in DDoS activity and turned parts of the internet into what one report characterized as a terabit-scale stress test. Government and industry tracking indicated the botnet was not an isolated spike but an active threat affecting organizations across regions, including the UK. Germany's **BSI** published an Aisuru botnet profile as defenders continued cataloging its infrastructure and behavior, while media reports said British businesses were hit by record botnet-driven barrages. Across the referenced reporting, Aisuru emerged as a large-scale botnet associated with compromised devices and capable of launching short, extremely intense floods that set new benchmarks for DDoS volume and forced providers to rely on automated mitigation at massive scale.
Jun 29, 2026
U.S., Canadian, and German authorities disrupted the command-and-control infrastructure of four major IoT botnets — **Aisuru, KimWolf, JackSkid, and Mossad** — that collectively compromised more than **three million** internet-connected devices worldwide. Investigators said the botnets, built largely from vulnerable **DVRs, IP cameras, web cameras, and enterprise Wi‑Fi routers**, were used in hundreds of thousands of distributed denial-of-service attacks, including operations targeting **U.S. Department of Defense** systems, other high-value networks, and critical infrastructure. Officials said the malware networks were capable of generating traffic above **30 Tbps**, with one attack reaching roughly **31.4 Tbps**, placing them among the largest DDoS threats recorded. The operators allegedly ran the infrastructure as a **DDoS-for-hire** service and also used it for extortion, threatening victims with sustained attacks unless they paid. The U.S. action, led by the Defense Criminal Investigative Service with support from the FBI Anchorage Field Office, included seizure warrants for domains and virtual servers, while Germany’s **BKA** and Canada’s **RCMP** carried out parallel enforcement steps. Private-sector partners including **Akamai, AWS, Cloudflare, Team Cymru, and The Shadowserver Foundation** supported the disruption. Authorities said the takedown degraded the botnets’ ability to operate, but warned that the underlying risk remains because millions of infected or insecure devices are still online with weak credentials or outdated firmware.
Jun 29, 2026