31.4 Tbps DDoS Attack Via Aisuru Botnet Breaks Internet With New World Record
On December 19, 2025, the Aisuru/Kimwolf botnet executed the largest publicly disclosed distributed denial-of-service (DDoS) attack, reaching 31.4 terabits per second (Tbps). This event, referred to as "The Night Before Christmas" campaign, targeted…
On December 19, 2025, the Aisuru/Kimwolf botnet executed the largest publicly disclosed distributed denial-of-service (DDoS) attack, reaching 31.4 terabits per second (Tbps). This event, referred to as "The Night Before Christmas" campaign, targeted Cloudflare's infrastructure with both Layer 4 DDoS attacks and application-layer HTTP floods surpassing 200 million requests per second.
The attack exceeded the previous record of 29.7 Tbps from September 2025, also attributed to the Aisuru botnet. Compromised Android TV devices served as the origin of this attack, exploiting unofficial streaming boxes to generate enormous traffic volumes.
Attack Distribution and Characteristics
The campaign entailed thousands of attacks with sophisticated coordination. Analysis revealed that 90.3% of attacks peaked at 1-5 Tbps, 5.5% at 5-10 Tbps, and 0.1% exceeded 30 Tbps. In terms of packet rate, 94.5% generated 1-5 billion packets per second (Bpps), while 4% peaked at 5-10 Bpps, and 1.5% reached 10-15 Bpps.
Most attacks lasted 60-120 seconds, with only 6% exceeding two minutes. Key sectors targeted included gaming (42.5%) and Information Technology and Services (15.3%). Geographically, the United States faced 30.8% of these attacks, followed by China and Hong Kong.
The attack exceeded the previous record of 29.7 Tbps from September 2025, also attributed to the Aisuru botnet.
The Aisuru botnet has evolved into a significant DDoS threat, with its Kimwolf variant infecting over 2 million Android TV devices. Despite mitigation efforts by Lumen Technologies' Black Lotus Labs, the botnet continues to adapt quickly.
The attack occurred amidst a rise in DDoS incidents, with 47.1 million attacks in 2025, marking a 121% increase from 2024. Cloudflare's systems successfully mitigated an average of 5,376 DDoS attacks per hour throughout the year.
Bangladesh emerged as the leading source of DDoS attacks in Q4 2025, followed by Ecuador and Argentina. Cloud computing platforms and telecommunications infrastructure were the primary networks used for launching these attacks.
Despite the scale of the attack, Cloudflare's infrastructure, with a 449 Tbps mitigation capacity, managed to handle the 31.4 Tbps assault effectively, utilizing only 7% of its available bandwidth.
Based on reporting by Cyber Security News.