https://www.bleepingcomputer.com/news/microsoft/microsoft-aisuru-botnet-used-500-000-ips-in-15-tbps-azure-ddos-attack/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Logitech confirms data breach after Clop extortion attack Logitech confirms data breach after Clop extortion attack + Fortinet confirms silent patch for FortiWeb zero-day exploited in attacks Fortinet confirms silent patch for FortiWeb zero-day exploited in attacks + Jaguar Land Rover cyberattack cost the company over $220 million Jaguar Land Rover cyberattack cost the company over $220 million + Decades-old 'Finger' protocol abused in ClickFix malware attacks Decades-old 'Finger' protocol abused in ClickFix malware attacks + xAI's Grok 4.1 rolls out with improved quality and speed for free xAI's Grok 4.1 rolls out with improved quality and speed for free + RondoDox botnet malware now hacks servers using XWiki flaw RondoDox botnet malware now hacks servers using XWiki flaw + Google Gemini 3 spotted on AI Studio ahead of imminent release Google Gemini 3 spotted on AI Studio ahead of imminent release + Eurofiber France warns of breach after hacker tries to sell customer data Eurofiber France warns of breach after hacker tries to sell customer data * Tutorials + Latest + Popular + How to access the Dark Web using the Tor Browser How to access the Dark Web using the Tor Browser + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide Acronis Electron stealers header * Home * News * Microsoft * Microsoft: Azure hit by 15 Tbps DDoS attack using 500,000 IP addresses * * Microsoft: Azure hit by 15 Tbps DDoS attack using 500,000 IP addresses By Sergiu Gatlan * November 17, 2025 * 12:13 PM * 0 DDoS Microsoft said today that the Aisuru botnet hit its Azure network with a 15.72 terabits per second (Tbps) DDoS attack, launched from over 500,000 IP addresses. The attack used extremely high-rate UDP floods that targeted a specific public IP address in Australia, reaching nearly 3.64 billion packets per second (bpps). "The attack originated from Aisuru botnet. Aisuru is a Turbo Mirai-class IoT botnet that frequently causes record-breaking DDoS attacks by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries," said Azure Security senior product marketing manager Sean Whalen. Wiz "These sudden UDP bursts had minimal source spoofing and used random source ports, which helped simplify traceback and facilitated provider enforcement." Cloudflare linked the same botnet to a record-breaking 22.2 terabits per second (Tbps) DDoS attack that reached 10.6 billion packets per second (Bpps) and was mitigated in September 2025. This attack lasted only 40 seconds but was roughly equivalent to streaming one million 4K videos simultaneously. One week earlier, the XLab research division of Chinese cybersecurity company Qi'anxin attributed another 11.5 Tbps DDoS attack to the Aisuru botnet, saying that it was controlling around 300,000 bots at the time. The botnet targets security vulnerabilities in IP cameras, DVRs/NVRs, Realtek chips, and routers from T-Mobile, Zyxel, D-Link, and Linksys. As XLab researchers said, it suddenly ballooned in size in April 2025 after its operators breached a TotoLink router firmware update server and infected approximately 100,000 devices. Infosec journalist Brian Krebs reported earlier this month that Cloudflare removed multiple domains linked to the Aisuru botnet from its public "Top Domains" rankings of the most frequently requested websites (based on DNS query volume) after they began overtaking legitimate sites, such as Amazon, Microsoft, and Google. The company stated that Aisuru's operators were deliberately flooding Cloudflare's DNS service (1.1.1.1) with malicious query traffic to boost their domain's popularity while undermining trust in the rankings. Cloudflare CEO Matthew Prince also confirmed that the botnet's behavior was severely distorting the ranking system and added that Cloudflare now redacts or completely hides suspected malicious domains to avoid similar incidents in the future. As Cloudflare revealed in its 2025 Q1 DDoS Report in April, it mitigated a record number of DDoS attacks last year, with a 198% quarter-over-quarter jump and a massive 358% year-over-year increase. In total, it blocked 21.3 million DDoS attacks targeting its customers throughout 2024, as well as another 6.6 million attacks targeting its own infrastructure during an 18-day multi-vector campaign. Wiz Secrets Security Cheat Sheet: From Sprawl to Control Whether you're cleaning up old keys or setting guardrails for AI-generated code, this guide helps your team build securely from the start. Get the cheat sheet and take the guesswork out of secrets management. Download Now Related Articles: Cloudflare mitigates new record-breaking 22.2 Tbps DDoS attack New Eleven11bot botnet infects 86,000 devices for DDoS attacks Azure outage blocks access to Microsoft 365 services, admin portals Prep smarter for Microsoft Azure exams with this $30 course bundle Microsoft: Windows bug blocks Microsoft 365 desktop app installs * Aisuru * Azure * Botnet * DDoS * Microsoft * * * * * Sergiu Gatlan Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips. * Previous Article * Next Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] ThreatLocker Popular Stories * Logitech Logitech confirms data breach after Clop extortion attack * Fortinet Fortinet confirms silent patch for FortiWeb zero-day exploited in attacks * Hacker AI cybersecurity Artificial Intelligence Anthropic claims of Claude AI-automated cyberattacks met with doubt Sponsor Posts * Securing Agentic AI: Redefine permissions for the next era of access Securing Agentic AI: Redefine permissions for the next era of access * Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free * AI is a data-breach time bomb: Read the new report AI is a data-breach time bomb: Read the new report Upcoming Webinar Webinar Follow us: * * * * * Main Sections * News * VPN Buyer Guides * SysAdmin Software Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT