ACCORDING to Cloudflare, the 2025 Q4 DDoS threat report records a record-setting 31.4 Tbps attack as part of a year of massive DDoS assaults. The fourth quarter focused on the Aisuru-Kimwolf botnet, dubbed “The Night Before Christmas” DDoS attack campaign, which began on 19 December 2025 and delivered hyper-volumetric HTTP DDoS attacks exceeding 20 million requests per second.
The campaign disrupted Cloudflare infrastructure and customers, but Cloudflare’s autonomous DDoS defence mitigated it, comprising 902 hyper-volumetric attacks (384 packet-intensive, 329 bit-intensive and 189 request-intensive). In 2025, DDoS activity surged with total attacks more than doubling to 47.1 million, while the year saw network-layer DDoS attacks more than triple and accounting for 78% of all DDoS attacks in Q4.
The Aisuru-Kimwolf botnet, largely consisting of Android TVs, is described as a malware-infected device network estimated at 1–4 million hosts, capable of launching large-scale assaults. The report also notes the year’s growth in hyper-volumetric attacks and highlights shifts in the most-attacked locations and top attack sources.