What Happened?

A DDoS botnet called AISURU / Kimwolf unleashed the largest attack ever recorded:

• 31.4 Terabits per second
• 35 seconds
• Target: HTTP infrastructure
• Detected and stopped automatically by Cloudflare

Blink and you missed it. But the message was loud.

Why This One Matters

This wasn’t a “spray and pray” attack.

It was:

• Ultra-short
• Ultra-massive
• Designed to overwhelm before humans could react

Think flash mob, not siege.

The Night Before Christmas (Literally)

Just weeks later, the same botnet launched a sequel:

Operation: The Night Before Christmas (Starting Dec 19, 2025)

Average attack size:

• 3B packets/sec
• 4 Tbps
• 54 million requests/sec

Peaks went even higher:

• 9B pps
• 24 Tbps
• 205 Mrps

This wasn’t noise. This was rehearsal.

The Bigger Picture (It’s Getting Worse)

Cloudflare’s numbers from 2025 are wild:

• 47.1 million DDoS attacks total
• 5,376 attacks mitigated every hour
• 121% increase YoY
• Network-layer attacks = 78% of all DDoS in Q4

Hyper-volumetric attacks?

• +700% in size compared to late 2024

The ceiling keeps moving.

The Botnet You Didn’t Know You Owned

AISURU/Kimwolf isn’t using supercomputers.

It’s using:

• 2+ million Android devices
• Mostly off-brand Android TVs
• Hidden behind residential proxy networks like IPIDEA

Many owners had no idea their TV was helping take down the internet.

Disruption in Progress

Good news: the party didn’t last forever.

• Google disrupted IPIDEA’s proxy network
• Legal action taken
• Domains seized
• DNS resolution blocked with help from Cloudflare

The bad news? There are dozens of copycats waiting in line.

Who’s Getting Hit (and Who’s Hitting)

Most attacked sectors:

• Telecom & ISPs
• IT & software
• Gaming & gambling

Top targets:

• China
• U.S.
• Germany
• Brazil
• U.K.
• India

Top attack sources:

• Bangladesh (now #1)
• Ecuador
• Indonesia
• Argentina

The internet is global. So is the blast radius.

The Cybernara View

At Cybernara we see this as a clear signal:

DDoS is no longer about duration. It’s about surprise.

If your defense strategy assumes:

• “We’ll see it coming”
• “We’ll react in minutes”
• “Our on-prem box will handle it”

…you’re already behind.

Modern attacks are machine-speed, cloud-scale, and over before coffee brews.

TL;DR

• Largest DDoS ever: 31.4 Tbps in 35 seconds
• DDoS attacks doubled in 2025
• Millions of Android TVs turned into weapons
• Cloud-based, always-on mitigation is no longer optional