Record-Breaking DDoS Attack Peaks at 31.4 Tbps

Cloudflare has disclosed details of what is now the largest publicly reported DDoS attack in history, an incident that peaked at an unprecedented 31.4 terabits per second (Tbps).

Attack Overview

The Aisuru Botnet

The attack was attributed to the Aisuru botnet, a relatively new but rapidly growing threat infrastructure that has demonstrated significant capabilities:

• Composition: Primarily compromised IoT devices and unpatched servers
• Geographic Distribution: Global, with concentrations in Asia and South America
• Attack Vectors: UDP amplification, SYN floods, and application-layer attacks
• Command & Control: Decentralized architecture making takedown difficult

"The Night Before Christmas" Campaign

The campaign began on December 19, 2025, and consisted of multiple short but extremely intense network-layer attacks:

Attack Timeline:
19 Dec 2025 03:14 UTC - Initial probe (2.1 Tbps)
19 Dec 2025 03:47 UTC - Escalation (14.8 Tbps)
19 Dec 2025 04:02 UTC - Peak attack (31.4 Tbps)
19 Dec 2025 04:11 UTC - Sustained attack (28.2 Tbps)
19 Dec 2025 04:23 UTC - Attack subsided

Previous Records

This attack significantly exceeds previous records:

Technical Analysis

The attack leveraged multiple amplification vectors simultaneously:

UDP Amplification Factors

Mitigation Strategies

Cloudflare's autonomous DDoS protection systems detected and mitigated the attack without human intervention:

1. Traffic Analysis: ML-based detection identified anomalous patterns
2. Rate Limiting: Automatic threshold adjustment
3. Anycast Distribution: Attack traffic distributed across global network
4. Filtering: Malicious packets dropped at edge

Implications for Organizations

This record-breaking attack demonstrates several concerning trends:

1. Scale Escalation: DDoS attacks continue to grow exponentially
2. IoT Vulnerability: Botnet size limited only by insecure devices
3. Short Bursts: Intense, short attacks can overwhelm defenses
4. Automation: Attacks are increasingly automated and sophisticated

Defensive Recommendations

Immediate Actions

# Check if your IPs are in known botnet lists
curl -s "https://check.torproject.org/torbulkexitlist" | grep YOUR_IP
 
# Monitor for unusual outbound traffic (potential bot infection)
netstat -an | grep ESTABLISHED | wc -l

Infrastructure Hardening

1. DDoS Protection Service: Use cloud-based mitigation (Cloudflare, Akamai, AWS Shield)
2. Rate Limiting: Implement at network and application layers
3. Anycast: Distribute services across multiple geographic regions
4. Monitoring: Real-time traffic analysis and alerting

IoT Security

• Change default credentials on all devices
• Disable UPnP where not required
• Segment IoT devices on separate VLANs
• Apply firmware updates regularly

References

• FastNetMon - Aisuru Botnet Sets DDoS Record
• SecurityWeek - Record-Breaking DDoS Attack
• Cloudflare Blog - DDoS Threat Report

Last updated: January 28, 2026

Related Reading

• Cloudflare 2026 Threat Report: 230 Billion Daily Threats as
• Massive Kimwolf Botnet Disrupts I2P Anonymous Network
• Pro-Russian Hacktivists Launch Sustained Cyber Campaign