Cloudflare's 2025 Q3 DDoS threat report -- including Aisuru, the apex of botnets

According to Cloudflare’s Quarterly DDoS Threat Report, the third quarter of 2025 was dominated by the Aisuru botnet, estimated at 1–4 million infected hosts globally, which unleashed hyper-volumetric DDoS attacks routinely exceeding 1 Tbps and 1 Bpps. The report notes a QoQ surge of 54% in these attacks, with a peak of 29.7 Tbps and 14.1 Bpps, and that since the start of 2025 Cloudflare has mitigated 2,867 Aisuru attacks, including 1,304 in Q3 alone.

Across all DDoS activity, Cloudflare mitigated 8.3 million attacks in Q3 2025, averaging 3,780 attacks per hour and marking a 15% QoQ and 40% YoY rise. Network-layer traffic accounted for 71% of attacks in 2025 Q3, with UDP DDoS increasing and DNS floods, SYN floods, and ICMP floods forming the rest; HTTP DDoS comprised about 29% of attacks.

The report also highlights Indonesia as the leading source of DDoS activity and notes notable surges in attacks against AI companies and various industries, including Mining, Minerals & Metals and Automotive.