Microsoft Mitigates Record 5.72 Tbps DDoS Attack Driven by AISURU Botnet

Microsoft disclosed that it automatically detected and neutralised a DDoS attack on a single Australian endpoint that peaked at 15.72 terabits per second and around 3.64 billion packets per second, marking the largest cloud-based DDoS observed to date. The assault was driven by a TurboMirai-class IoT botnet known as AISURU, and originated from more than 500,000 source IPs across various regions, with UDP floods targeting a public IP address.

The company noted that these UDP bursts had minimal source spoofing and used random source ports, which aided traceback and enforcement by providers. According to QiAnXin XLab, AISURU is powered by nearly 300,000 infected devices, including routers, security cameras and DVRs, and has been linked to some of the biggest DDoS attacks recorded. Microsoft’s Sean Whalen said the attack involved extremely high-rate UDP floods and underscored a growing baseline as internet speeds rise and IoT devices become more capable.

NETSCOUT has also highlighted the evolving threat landscape around TurboMirai-like botnets, with further context on related campaigns.