Loading story…
In September 2025, Qrator Labs thwarted a major Layer 7 DDoS attack targeting a government organization, leveraging a botnet of 5.76 million compromised IoT devices. The botnet, first observed in March with 1.33 million devices, rapidly expanded to nearly six million by September. The attack was executed in two waves and sourced traffic from multiple countries, with significant growth in India and Vietnam.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Qrator Labs reported that the largest botnet it tracks grew from roughly **1.33 million** devices in March 2025 to **13.5 million** devices in Q1 2026, driving a new wave of massive distributed denial-of-service attacks against financially focused organizations. The firm said **FinTech, banks, and payment systems** were the most targeted sectors, as attackers increasingly combined **L3/L4** and **L7** techniques in larger, more complex multi-vector campaigns. It also recorded a rise in bad-bot activity, with an average of **2.5 billion blocked requests per month**. One of the most significant incidents hit the betting industry in mid-March, peaking at **2.065 Tbps** and nearly **1 billion packets per second** over about **40 minutes**, with attackers shifting tactics **11 times** during the assault. Qrator linked the broader trend to evolving botnet tradecraft, including a new loader called **Aeternum C2** that uses the **Polygon** blockchain for decentralized command-and-control, and to the continued evolution of large-scale botnet operations previously associated with record-setting campaigns such as **Mēris**.
Jun 29, 2026
A March multinational operation involving the United States, Canada, and Germany disrupted infrastructure supporting the Aisiru and Kimwolf botnets, contributing to a fall in the largest observed botnet from 13.5 million devices in Q1 2026 to 2.09 million in Q2. Link11 also reported a 42% decline in DDoS attacks in Europe during the first half of 2026, partly attributing the reduction to law-enforcement actions including Operation Eastwood and the shutdown of four IoT botnets. Attackers are compensating with more powerful and resilient campaigns: Link11 recorded peaks of **2.3 Tbit/s** and **322 million packets per second**, with 705 TB of cumulative malicious traffic, driven by super-botnets and hijacked cloud servers. Operators are increasingly dispersing traffic sources and adopting decentralized command infrastructure; the Aeternum and Void botnets use Polygon and Ethereum smart contracts for C2 distribution. DDoS surges are also being used to conceal SQL-injection and XSS probing, requiring defenses that combine continuous traffic inspection, behavioral detection, adaptive filtering, and application-layer monitoring.
Sep 4, 2026A leading DDoS scrubbing provider in Western Europe was hit by a record-breaking distributed denial-of-service attack peaking at 1.5 billion packets per second. The attack, launched from over 11,000 networks using compromised IoT and MikroTik routers, was successfully mitigated by FastNetMon's automated detection and response platform. The incident highlights the escalating scale of DDoS threats and the urgent need for ISP-level intervention to prevent mass exploitation of consumer hardware.
Jun 29, 2026