Aisuru-Kimwolf Botnet: 31.4 Tbps DDoS, 3M Devices Exposed Now

In the evolving landscape of cyber threats, few incidents have captured the attention of security experts like the Aisuru-Kimwolf botnet. This sprawling network of compromised devices has unleashed some of the most powerful distributed denial-of-service (DDoS) attacks ever recorded, peaking at an astonishing 31.4 terabits per second (Tbps). By exploiting vulnerabilities in Internet of Things (IoT) gadgets and Android streaming devices, operators behind this botnet have demonstrated the devastating potential of poorly secured connected hardware. This article delves into the botnet’s origins, operational mechanics, attack campaigns, and the global efforts to dismantle it, offering insights for businesses and individuals alike to bolster their defenses.

Origins and Rapid Expansion of the Botnet

The Aisuru-Kimwolf botnet emerged in late 2025, quickly growing into one of the largest IoT-based threat networks. Aisuru laid the groundwork, infecting devices through weak security protocols common in routers, cameras, and smart home appliances. Kimwolf followed as an advanced iteration, expanding the reach by targeting over two million Android devices, particularly off-brand TV streamers preloaded with residential proxy software.

These proxies, often bundled with apps and games without user knowledge, became unwitting conduits for malware propagation. Residential networks provided the botnet with legitimate-looking IP addresses, evading traditional detection methods. By January 2026, the combined Aisuru-Kimwolf infrastructure, alongside affiliates like JackSkid, controlled more than three million devices worldwide, enabling hyper-volumetric assaults that overwhelmed even robust content delivery networks (CDNs).

• Key Growth Factors: Factory-installed proxy apps on Android TVs tunneled malicious traffic.
• Infection Vectors: DNS TXT records and Ethereum Name Service (ENS) for resilient command propagation.
• Geographic Spread: Infections spanned residential Wi-Fi, enterprises, and even security research environments.

Technical Blueprint: How the Botnet Operates

At its core, the Aisuru-Kimwolf botnet functions as a decentralized army of zombies—compromised devices awaiting instructions from command-and-control (C2) servers. Malware variants scan for open ports, exploit default credentials, and establish persistent connections. Once enslaved, devices join amplification techniques, flooding targets with massive packet volumes.

Aisuru pioneered DNS-based C2 using TXT records to relay server locations, dodging takedowns. Kimwolf innovated further with ENS text records on the Ethereum blockchain, allowing operators to update IPs dynamically even if primary servers fell. This resilience fueled over 200,000 DDoS commands from Aisuru and 25,000 from Kimwolf, alongside related botnets issuing tens of thousands more.

Operators, allegedly including figures like ‘Dort’ and ‘Snow,’ monetized the botnet through extortion, renting DDoS firepower, and proxy services for illicit activities such as account takeovers.

Record-Shattering DDoS Campaigns

The botnet’s hallmark was its hyper-volumetric DDoS attacks, leveraging IoT scale for bandwidth saturation. In December 2025, during the ‘Night Before Christmas’ campaign, assaults averaged 4 Tbps and 54 million requests per second (Mrps), spiking to 24 Tbps and 205 Mrps. The pinnacle came with a 35-second barrage at 31.4 Tbps and 200 million requests per second, crippling a major CDN.

February 2026 saw targeting of the I2P anonymization network, highlighting strategic shifts beyond financial motives. Quarterly trends showed a 40% rise in such attacks, with sizes ballooning 700% from late 2024. Victims faced outages costing tens of thousands in losses and remediation.

• December 2025 Peak: 31.4 Tbps, 9 billion packets per second (Bpps).
• Q4 2025 Surge: 1,824 hyper-volumetric incidents vs. 1,304 prior.
• Extortion Tactics: Demands followed massive floods.

Enterprise and Consumer Risks Exposed

Enterprises scanning 25% of cloud customers revealed widespread exposure. Kimwolf infiltrated local Wi-Fi via proxies, turning smart TVs into attack vectors. Even security firms hosted infected researcher devices, underscoring pervasive threats. Android malware tunneled through proxies for ad fraud and scraping, blending DDoS with financial crimes.

Consumers remain vulnerable via obscure app permissions adding devices to proxy pools. Enterprises must prioritize IoT segmentation, firmware updates, and proxy monitoring to mitigate risks.

Global Disruption Efforts and Countermeasures

By early 2026, international law enforcement, led by U.S. authorities in Alaska, executed court-authorized operations dismantling over 500 C2 servers for Aisuru, Kimwolf, JackSkid, and Mossad botnets. Google disrupted IPIDEA proxies, seizing domains. Security researchers paralyzed infrastructures, prompting botnet retaliation via doxxing on ENS.

Despite setbacks, the botnet’s decentralized design poses ongoing challenges. Defenses include behavioral detection, rate limiting, and autonomous edge scrubbing.

Future Implications for Cybersecurity

The Aisuru-Kimwolf saga signals an era of IoT-driven mega-attacks. With 47.1 million DDoS incidents in 2025, rising botnet scales demand proactive measures: zero-trust architectures, AI-driven anomaly detection, and regulatory pushes for IoT security standards. As connected devices proliferate, vigilance against proxy abuses and blockchain C2 will define resilience.

Frequently Asked Questions (FAQs)

What devices does the Aisuru-Kimwolf botnet target?

Primarily IoT routers, cameras, and off-brand Android TV streamers with preinstalled proxy software.

How large was the biggest attack?

A 31.4 Tbps DDoS lasting 35 seconds, with 200 million requests per second.

Who operated the botnet?

Alleged controllers include ‘Dort’ from Canada and ‘Snow,’ using shared infrastructure.

Is the botnet still active?

Law enforcement disruptions in 2026 have impaired it, but remnants may persist.

How can I protect my IoT devices?

Change default passwords, update firmware, segment networks, and monitor for proxy traffic.