Loading threat actor…
Aisuru-Kimwolf is a Mirai-derived botnet cluster associated with very large distributed denial-of-service operations. It has been linked to record-setting volumetric attacks, including campaigns reaching 31.4 Tbps and 14.1 billion packets per second. Reporting identifies Aisuru as a Mirai-based botnet and KimWolf as a related variant that targets Android systems, including mobile devices and smart TVs. The combined naming reflects operational overlap or joint attribution in major DDoS incidents. The actor’s activity is characterized by large-scale network-layer flooding and botnet-enabled attack delivery. Observed tradecraft includes packet randomization to complicate filtering and the use of residential proxy infrastructure to obscure attack origins and evade defenses. The broader ecosystem around these operations has been described as for-hire criminal botnet activity, with access to infected devices sold to customers for launching attacks. Aisuru-Kimwolf sits within the wider Mirai lineage, which continues to exploit insecure internet-connected devices, especially systems left with default credentials or lacking updates. Public reporting also notes law-enforcement disruption actions affecting Aisuru and KimWolf infrastructure, but the threat has persisted despite takedowns. The actor is best understood as a financially motivated DDoS botnet operation centered on attack-for-hire services and high-volume denial-of-service capability rather than espionage or intrusion-focused objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A DDoS botnet attributed with launching a record-breaking 31.4 Tbps and 200 million requests per second attack referenced as part of Cloudflare's broader DDoS reporting.
Botnet operators linked to record-breaking DDoS attacks and associated with Mirai-based botnet activity sold as for-hire services.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.