(Credit: Guilherme Soares via Getty Images)
The notorious botnet known as Aisuru has launched an unprecedented distributed denial-of-service (DDoS) attack, reaching a staggering 29.7 Tbps.
Internet infrastructure provider Cloudflare reported the record-breaking attack, which is designed to overwhelm a website, app, or server, and take it offline. The 29.7 Tbps assault, which happened in early October, lasted just over a minute and attempted to flood about 15,000 destination ports per second.
"The distributed attack randomized various packet attributes in an attempt to evade defenses,” Cloudflare added.
(Credit: Cloudflare)The previous record was 22.2 Tbps, which occurred in September and was traced to the Aisuru botnet attempting to disrupt a European network infrastructure company.
In a worrying sign, Cloudflare estimates that Aisuru has grown to infect 1 to 4 million devices globally, up from earlier estimates of 300,000 to 400,000 devices.
Cloudflare, which offers DDoS protection services, didn't identify the target of the 29.7 Tbps attack. However, the company claims it has been able to automatically fend off the assaults from Aisuru, despite their increasing intensity. “Since the start of 2025, Cloudflare has already mitigated 2,867 Aisuru attacks. In the third quarter alone, Cloudflare mitigated 1,304 hyper-volumetric attacks launched by Aisuru,” the company said.
Cloudflare is warning that Aisuru could cause major disruptions if it targets internet infrastructure that lacks sufficient DDoS protection. “Imagine what it can do when it’s directly aimed at unprotected or insufficiently protected ISPs, critical infrastructure, healthcare services, emergency services, and military systems,” the company says.
The creators of Aisuru have been selling access to the botnet, enabling buyers to DDoS targets, such as gaming companies, Minecraft servers, and hosting providers. Aisuru has grown by infecting vulnerable IoT devices, including routers and security cameras, to summon the bandwidth to bombard targets.
It was once rare for DDoS attacks to exceed 1 Tbps. But Aisuru appears to be exploiting the high-speed connections from ISPs, including those in the US such as AT&T, Comcast, and Charter Communications, according to security journalist Brian Krebs. This can create congestion on a network, slowing speeds for subscribers not even targeted in the DDoS.
In October, Krebs also spotted signs that Aisuru had launched a 29.69 Tbps DDoS, but as an apparent demonstration that only lasted a few seconds and targeted a single test server.