AISURU Botnet: From Record-Breaking DDoS to Residential Proxy Empire

The AISURU botnet, first disclosed by XLab in 2024, has rapidly become a major force in the DDoS landscape, with 2025 seeing multiple record-breaking attacks, including an 11.5 Tbps event mitigated by Cloudflare. According to XLab, peak bandwidth for global DDoS attacks rose from 3.12 Tbps at the start of 2025 to 11.5 Tbps recently, as AISURU operated behind the scenes across high-impact incidents.

The group behind AISURU comprises three operators codenamed Snow, Tom, and Forky, who exploited vulnerabilities in consumer networking devices, with Tom breaching a Totolink router firmware update server in April 2025 to hijack update requests. By mid‑2025 the botnet had grown to nearly 300,000 active nodes, many of them home routers distributed across China, the U.K., the U.S., Germany and Hong Kong.

It has since expanded into residential proxy services, enabling attackers to monetise its large node pool and support stealthier operations including fraud and credential stuffing. The trajectory highlights the convergence of DDoS capability and proxy infrastructure in AISURU’s evolving criminal ecosystem.