Aisuru botnet is behind record 20Tb/sec DDoS attacks

In October 2025, a new Mirai-based IoT botnet dubbed Aisuru was used to launch multiple high-impact DDoS attacks exceeding 20Tb/sec and 4gpps, with Netscout reporting attacks primarily targeting online gaming. The botnet operates via residential proxies and its nodes are mainly consumer routers, CCTV/DVRs and other vulnerable CPE devices, with operators continually seeking new exploits to grow the network.

Acting as a DDoS-for-hire service, Aisuru avoids government and military targets, but broadband providers faced serious disruptions from attacks exceeding 1.5Tb/sec from infected customer devices. According to Netscout, Aisuru and related TurboMirai-class IoT botnets can generate both high-bandwidth large-packet attacks and high-pps small-packet attacks, and use UDP, TCP and GRE floods across a range of port configurations.

The report notes that some traffic mimics legitimate HTTP packets and that the botnet traffic is not spoofed due to limited privileged access and lack of source-address validation in many networks.