Aisuru Botnet Strikes Again: Massive DDoS Attack on Microsoft’s Azure Network!

Hot Take:

It seems the Aisuru botnet has taken a page out of the “go big or go home” playbook, and while it’s not winning any popularity contests, it sure is keeping the cybersecurity world on its toes. With a ferocity that rivals a hungry toddler at a birthday party, Aisuru is making waves faster than you can say “Do you even DDoS, bro?”.

Key Points:

• Microsoft faced a 15.72 Tbps DDoS attack on its Azure network, courtesy of the Aisuru botnet.
• Aisuru, a Turbo Mirai-class IoT botnet, launched the assault using UDP floods from over 500,000 IP addresses.
• The botnet has been linked to other massive DDoS attacks, including a 22.2 Tbps attack mitigated by Cloudflare.
• Aisuru thrives by exploiting vulnerabilities in home routers and IoT devices, expanding its reach in April 2025.
• Cloudflare has taken steps to mitigate Aisuru’s influence on DNS rankings by redacting malicious domains.

Terabits, Schmerabits – Who’s Counting?

Microsoft recently found itself in the eye of a digital storm when its Azure network was hit with a staggering 15.72 terabits per second (Tbps) DDoS attack. The culprits? The infamous Aisuru botnet, a Turbo Mirai-class IoT botnet with a knack for causing chaos. Using high-rate UDP floods, Aisuru unleashed its fury from over 500,000 IP addresses, targeting a specific public IP address in Australia. It’s almost as if Aisuru was trying to set a new world record for the most packets sent per second – 3.64 billion, to be precise!

Botnets Gone Wild: Aisuru’s Global Tour

The Aisuru botnet is no stranger to the spotlight. This digital troublemaker has been linked to a record-shattering 22.2 Tbps DDoS attack, mitigated by Cloudflare in September 2025. With a burst of data equivalent to streaming one million 4K videos simultaneously, Aisuru’s 40-second attack was brief but impactful. And just a week earlier, Aisuru orchestrated another 11.5 Tbps attack, proving that it’s not just a one-hit wonder. The botnet’s modus operandi involves exploiting vulnerabilities in devices like IP cameras, routers, and Realtek chips, making it the digital equivalent of a door-to-door salesman nobody wants to answer.

The Rise and Rise of Aisuru

In April 2025, the Aisuru botnet experienced a growth spurt after its operators hacked a TotoLink router firmware update server and infected around 100,000 devices. Like a digital Pied Piper, Aisuru managed to control approximately 300,000 bots, expanding its reach and influence. Infosec journalist Brian Krebs reported that Aisuru’s antics even led to Cloudflare removing multiple domains linked to the botnet from its “Top Domains” rankings. Apparently, Aisuru’s operators flooded Cloudflare’s DNS service to boost their domain’s popularity, proving once again that when it comes to digital mischief, Aisuru is the king of the hill.

Cloudflare’s Defense: The Cybersecurity Version of Whack-a-Mole

Cloudflare, not one to take things lying down, has taken steps to curb Aisuru’s influence. CEO Matthew Prince confirmed that the botnet’s behavior was distorting the ranking system, prompting Cloudflare to redact or hide suspected malicious domains. The company’s 2025 Q1 DDoS Report revealed a staggering 198% quarter-over-quarter increase in DDoS attacks, with a total of 21.3 million attacks blocked in 2024. It’s clear that Aisuru’s not just a thorn in Cloudflare’s side, but in the entire cybersecurity industry’s side. But fear not, for Cloudflare is playing the digital version of whack-a-mole to keep Aisuru and its ilk at bay.