TurboMirai-Class ‘Aisuru’ Botnet Blamed for 20+ Tbps DDoS Attacks

TurboMirai-class ‘Aisuru’ is a newly observed Mirai-style DDoS botnet whose attacks have reportedly exceeded 20 terabits per second, forming part of a broader class described by Netscout as TurboMirai. The research notes that, unlike some IoT threats, Aisuru browsers do not spoof traffic on the network, a trait that Benches defenders to identify and remediate affected devices more easily.

Operated as a DDoS-for-hire service, Aisuru has largely targeted online gaming platforms while explicitly avoiding governmental, law enforcement, and military entities. The botnet uses a mix of high-bandwidth and high-throughput capabilities and includes functions for credential stuffing, AI-based web scraping, phishing, and spamming, along with a residential proxy service.

Its infected devices are predominantly consumer-grade broadband routers, CCTV cameras, DVRs, and similar devices running OEM firmware, with traffic directed via direct-path UDP, TCP, GRE and DNS floods alongside more advanced techniques. Written by Ionut Arghire, SecurityWeek reported the findings on 28 October 2025. according to Netscout.