AISURU Botnet Fuels Record-Breaking 11.5 Tbps DDoS Attack With 300,000 Hijacked Routers

The AISURU botnet, leveraging an estimated 300,000 compromised routers worldwide, has been identified as the force behind a record-breaking 11.5 Tbps distributed denial-of-service attack in September 2025, according to XLab. This unprecedented event eclipses the 5.8 Tbps peak recorded earlier in the year, and underscores a sharp escalation in botnet scale and sophistication.

In April 2025, Tom orchestrated the compromise of a Totolink router firmware update server by planting a malicious script to redirect devices to download AISURU malware, with the network swelling to more than 100,000 nodes within weeks and peaking at roughly 300,000 infected routers.

Cross-referencing leaked screenshots of the botnet management panel and Cloudflare mitigation logs helped validate the insider’s claims and establish AISURU’s culpability in several record-breaking attacks, including a 11.5 Tbps strike mitigated by Cloudflare. The campaign exploits a range of vulnerabilities, including CVE-2017-5259, CVE-2023-28771, and CVE-2023-50381, and relies on GRE tunnels via four C2 IPs (151.242.2[.]22–25) to amplify traffic through hijacked devices.