DDoS Botnet Aisuru Blankets US ISPs in Record DDoS

The Krebs on Security report details Aisuru, a DDoS botnet that has shifted its heavy weaponry onto compromised IoT devices hosted by U.S. Internet providers such as AT&T, Comcast and Verizon, with researchers noting a concentration of infected devices inside US networks. The botnet’s capacity has surged past previous records, culminating in a 29.6 terabits-per-second attack on October 6 that lasted only a few seconds, following earlier near-records of 6.35 Tbps in May and over 11 Tbps days later.

By late September, Aisuru was publicly flexing DDoS capabilities above 22 Tbps, and researchers say the recent activity involved about 300,000 compromised hosts worldwide. The campaign has frequently targeted gaming services and Minecraft hosts, with impact extending to some ISPs’ ability to deliver normal service during attacks; industry observers note 500 gigabits of traffic leaving Comcast’s network during one incident.

The report also notes that the botnet’s operators have been renting it as a residential proxy network, a practice discussed by security professionals in the wake of these disruptions, according to Project Shield’s mitigations.