Massive L7 DDoS Botnet Exploits 5.76M Hijacked Devices for Record Attacks

Qrator Labs has revealed that a sprawling Layer 7 DDoS botnet has swollen to 5.76 million compromised devices, unleashing unprecedented traffic against critical online services. Monitored since late March, the botnet’s first assault on March 26 saw approximately 1.33 million unique IP addresses targeting an online betting organisation’s web apps.

According to Qrator Labs, the majority of participating devices hailed from Brazil, Argentina, Russia, Iraq and Mexico, with HTTP GET requests designed to exhaust application-layer resources and cause degradation and outages. Barely two months later, on May 16, the botnet re-emerged, now exploiting 4.6 million devices to strike government sector portals and citizen-facing services.

By early September, the attacks had peaked at 5.76 million devices, split into two waves: about 2.8 million IP addresses in the first wave and a further 3 million in the second, with Brazil contributing 1.41 million IPs and other notable shares from Vietnam, the United States, India and Argentina.

Andrey Leskin, CTO at Qrator Labs, warned that such a scale can generate tens of millions of requests per second to overwhelm servers, emphasising the need for multi-layered protections, including scalable DDoS mitigation and vigilant incident response planning.