The AISURU/Kimwolf botnet launched a record-setting hyper-volumetric HTTP DDoS attack in November 2025 that peaked at 31.4 Tbps for 35 seconds and later ran the “The Night Before Christmas” campaign with wins up to 24 Tbps and 9 Bpps. Cloudflare and Google disrupted the supporting IPIDEA residential proxy infrastructure that had enslaved over 2 million mostly off‑brand Android devices via trojanized apps and binaries, as Cloudflare reported DDoS activity surged to 47.1 million attacks in 2025. #AISURU #IPIDEA
Keypoints
- AISURU/Kimwolf executed a record 31.4 Tbps DDoS peak in November 2025 that lasted 35 seconds.
- The “The Night Before Christmas” campaign averaged 3 Bpps, 4 Tbps, and 54 Mrps and peaked at 9 Bpps, 24 Tbps, and 205 Mrps.
- Cloudflare mitigated 34.4 million network-layer DDoS attacks in 2025, contributing to a total of 47.1 million DDoS attacks for the year, a 121% increase.
- IPIDEA enrolled devices via at least 600 trojanized Android apps and 3,000 trojanized Windows binaries, and Google and Cloudflare moved to disrupt the proxy network and associated domains.
- Telecommunications and service providers were the most targeted sectors, and Bangladesh became the largest listed source of DDoS traffic, surpassing Indonesia.
Read More: https://thehackernews.com/2026/02/aisurukimwolf-botnet-launches-record.html