Largest Azure DDoS Attack Powered by Aisuru Botnet

Microsoft said the DDoS attack aimed at its Azure cloud service was the “largest DDoS attack ever observed in the cloud,” peaking at 15.72 Tbps and nearly 3.64 Bpps, and targeted a single endpoint in Australia on October 24. Similar to the 22 Tbps attack observed by Cloudflare, the Azure incident was powered by the Aisuru botnet, described as a TurboMirai-class IoT network.

The attack involved extremely high-rate UDP floods launched from over 500,000 source IPs across various regions, with minimal source spoofing and random source ports, which aided traceback and enforcement by providers, according to Microsoft’s Sean Whalen. Aisuru has been offered as a DDoS-for-hire service and has historically been connected to large DDoS campaigns, particularly against online gaming platforms, while also enabling credential stuffing, web scraping, phishing and spamming. The largest publicly reported DDoS attack to date, at 22.2 Tbps and 10.6 Bpps, was attributed to Cloudflare, according to Cloudflare.