DDoS Attacks: 29.7 Tbps Record And Mitigation Guide For 2025

Distributed Denial of Service (DDoS) attacks represent one of the most disruptive threats in modern cybersecurity. These assaults flood targets with overwhelming traffic, aiming to knock services offline and cause chaos. Over the years, attackers have escalated their tactics, leveraging massive botnets to unleash floods measured in terabits per second (Tbps) or millions of requests per second (RPS). This article examines some of the most notorious incidents, highlighting their scale, methods, and the innovative defenses that countered them. From early gigabit-scale barrages to today’s hyper-volumetric onslaughts, these events underscore the evolving arms race between attackers and protectors.

The Mechanics Behind Massive DDoS Campaigns

At their core, DDoS attacks exploit the internet’s distributed nature. Attackers compromise thousands or millions of devices—often IoT gadgets, servers, or endpoints—forming botnets. These zombie armies then bombard targets with junk traffic, exhausting bandwidth, processing power, or connection limits. Common vectors include UDP floods, which swamp ports with datagrams; reflection/amplification attacks, like NTP or DNS queries that multiply traffic; and application-layer assaults targeting web servers with HTTP requests.

Modern botnets like Mirai variants and Aisuru have supercharged these efforts. Mirai, first prominent in 2016, infected unsecured IoT devices, enabling attacks up to several Tbps. Newer strains, such as Aisuru detected in 2025, command 1-4 million hosts, delivering sustained peaks above 1 Tbps daily. Attackers rent these networks cheaply on underground markets, democratizing disruption for hacktivists, extortionists, or state actors.

• Volumetric Attacks: Raw bandwidth floods, measured in Tbps or packets per second (pps).
• Application-Layer: HTTP floods mimicking legitimate traffic, measured in RPS.
• Multi-Vector: Combining floods, reflections, and exploits for harder mitigation.

Defenses rely on global networks like those from Cloudflare or Google, using autonomous edge scrubbing, rate limiting, and AI-driven anomaly detection to absorb and filter malice without impacting legitimate users.

Record-Shattering Volumetric Assaults: Tbps Titans

The push for bigger floods has birthed jaw-dropping records. In Q3 2025, a staggering 29.7 Tbps attack targeted a hosting provider via the Aisuru botnet. Lasting 69 seconds, it hurled hyper-volumetric UDP floods from 1-4 million devices worldwide. Cloudflare’s autonomous systems neutralized it, preventing downtime. This eclipsed prior marks, with Aisuru alone spawning 2,867 attacks since early 2025, up 54% quarter-over-quarter.

Earlier in May 2025, an 11.5 Tbps barrage hit another hoster, dumping 37.4 TB of data—equivalent to 9,000 HD movies—in 45 seconds. Sourced from 122,000 IPs, it was 99.996% UDP floods laced with QOTD, Echo, NTP reflections, and Mirai variants. Cloudflare’s Magic Transit service scrubbed it at the edge.

Not far behind, a 7.3 Tbps multi-vector attack in mid-May 2025 carpet-bombed 21,925 ports per IP, peaking at 34,517 destination ports per second. It combined UDP floods with rare RIPv1 and Portmap amplifications, originating globally. Again, automated mitigation prevailed.

These incidents reveal a pattern: hosting providers and ISPs bear the brunt, as crippling them cascades disruptions. Eastern Asia saw a 5.6 Tbps Mirai-variant hit on an ISP from 13,000 IoT devices, all UDP-focused but fully mitigated.

Application-Layer Nightmares: RPS Explosions

While volumetric attacks hog bandwidth, Layer 7 floods stress servers with seemingly valid requests. Google’s October 2023 defense of a 398 million RPS HTTP/2 “Rapid Reset” attack set an RPS benchmark. This zero-day exploited Rapid Reset flaws, sending bursts that evaded traditional filters. Google absorbed it via global anycast scrubbing.

Cloudflare faced its own Layer 7 monster: a 17.2 million RPS HTTP flood in 2025, triple prior records. A financial sector customer endured 330 million initial requests from 20,000 bots across 125 countries—15% from Indonesia alone. The same botnet hit others at 8 million RPS and launched 1.2 Tbps network assaults on telecoms and gamers. No intervention needed; edges handled it.

In June 2022, a 26 million RPS “Mantis” botnet of 5,067 nodes hammered a site at 5,200 RPS per device. HTTPS usage upped costs for attackers. April 2022’s 15.3 million RPS on a crypto platform used 6,000 devices from 112 nations, also HTTPS-based.

Early Milestones: From Gbps to Tbps Evolution

DDoS history traces to simpler times. The 2013 Spamhaus attack peaked at 300 Gbps via DNS reflection, overwhelming LINX and providers. A UK teen-for-hire orchestrated it; Cloudflare’s protection saved Spamhaus, but attackers pivoted, causing broader fallout.

2014’s 400 Gbps NTP exploit targeted a European Cloudflare client, degrading the provider’s network. These Gbps-era attacks paved the way for IoT-fueled Tbps leaps post-Mirai.

Attack Motivations and Global Ripples

Why these behemoths? Extortion dominates, but hacktivism (e.g., geopolitical floods) and competition takedowns surge. Aisuru’s for-hire chunks cost hundreds, enabling nation-scale chaos. Impacts ripple: economic losses in millions, service blackouts affecting millions. In 2025 Q1, Cloudflare blocked 20+ million attacks, up 358% YoY, with 5.6 Tbps/4.8 Bpps records.

Fortifying Against Future Floods

Lessons abound. Anycast networks distribute load; AI spots anomalies; autonomous mitigation scales. Users must secure IoT, patch vulnerabilities, and layer defenses. Botnet takedowns—like Mirai’s source code arrests—curb supply, but underground evolution persists.

Frequently Asked Questions

What is the largest DDoS attack ever recorded?

The 29.7 Tbps Aisuru botnet attack in Q3 2025 holds the volumetric record, mitigated by Cloudflare.

How do botnets like Aisuru and Mirai work?

They infect unsecured devices globally, then coordinate floods via command servers, often rented cheaply.

Can DDoS attacks be fully prevented?

Not always, but robust scrubbing and global capacity mitigate most, keeping services online.

Why target hosting providers and ISPs?

They amplify impact, disrupting countless downstream users with single-point failures.

What’s the difference between Tbps and RPS attacks?

Tbps measures bandwidth volume; RPS targets application processing with request floods.