A new 29.7 Tbps distributed denial-of-service (DDoS) blast from the Aisuru botnet has set a new world record for attack volume, underscoring how fragile core internet infrastructure remains under extreme load.
The previous record of 22Tbps, quietly broken in Q3 2025 and mitigated by Cloudflare, pushes global defenders into an era where multi-terabit attacks are no longer outliers but a recurring operational reality.
Cloudflare’s latest DDoS threat report confirms that Aisuru drove a hyper-volumetric network-layer attack that peaked at 29.7 Tbps and approximately 14.1 billion packets per second, eclipsing previous records near 22 Tbps.
The attack used a UDP “carpet bombing” technique that hammered roughly 15,000 destination ports per second while randomizing packet attributes to slip past static filtering and legacy scrubbing centers.
Despite the unprecedented scale, Cloudflare says its autonomous mitigation stack detected and filtered the traffic in seconds, keeping the target online and preventing visible customer impact.
29.7 Tbps DDoS Attack
Behind the record is a botnet that Cloudflare now estimates at roughly 1–4 million compromised devices worldwide, making Aisuru the dominant DDoS botnet in the current threat ecosystem.
Since the start of 2025, Cloudflare has mitigated 2,867 Aisuru attacks, including 1,304 hyper-volumetric events in Q3 alone, a 54% quarter-over-quarter jump that translates to an average of about 14 such mega-attacks every day.
Portions of the botnet are openly brokered as “chunks” for hire, meaning would‑be attackers can rent enough capacity to saturate backbone links or cripple national ISPs for only a few hundred to a few thousand dollars.
Overall, Cloudflare blocked 8.3 million DDoS attacks in Q3 2025, up 15% quarter-over-quarter and 40% year-over-year, bringing the 2025 year‑to‑date total to 36.2 million attacks, already 170% of the full‑year 2024 volume with a quarter still to go.
Network-layer DDoS made up about 71% of all attacks in the quarter, surging 87% QoQ and 95% YoY, while HTTP-layer attacks fell 41% QoQ and 17% YoY, highlighting attackers’ pivot back to raw transport and bandwidth exhaustion.
At the extreme end, incidents exceeding 100 million packets per second jumped 189% QoQ, and those above 1 Tbps grew 227%, yet the majority of these barrages ended within 10 minutes, too fast for manual response or on-demand mitigation contracts to reliably catch.
The impact of Aisuru is clear: KrebsOnSecurity reports that a large amount of botnet traffic has caused major disruptions across U.S. internet service providers, even though they were not the intended targets.
Cloudflare’s telemetry shows Aisuru and other actors routinely aiming at telecommunications providers, gaming platforms, hosting companies, and financial services firms, while information technology and services, telecoms, and gambling and casinos ranked as the most attacked industries overall in Q3.
At the same time, DDoS traffic against generative AI providers spiked by up to 347% month‑over‑month in September, and attacks on the mining, minerals, and metals, and automotive sectors surged in step with EU–China trade tensions over rare earths and electric vehicle tariffs.
Cloudflare links sharp changes in attack geography to street‑level unrest and political flashpoints, with Indonesia remaining the top global source of DDoS traffic and having logged a 31,900% increase in HTTP DDoS requests since 2021.
In Q3 2025, the Maldives, France, and Belgium all recorded dramatic jumps in DDoS activity alongside mass protests from Maldivian crowds rallying under the slogan “Stop the Loot!” to France’s “Block Everything” strikes and large Gaza solidarity marches in Brussels.
China stayed the most-targeted country, followed by Turkey and Germany, while the United States climbed into fifth place and the Philippines posted the biggest rise within the top 10, reinforcing how tightly modern DDoS campaigns now track geopolitical conflict, public anger, and regulatory fights over AI and trade.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post 29.7 Tbps DDoS Attack Via Aisuru Botnet Breaks Internet With New World Record appeared first on Cyber Security News.