Loading story…
Cloudflare reported automatically mitigating more than 100 hyper-volumetric Layer 3/4 DDoS attacks during a month-long campaign beginning in September 2024. The attacks targeted customers in financial services, Internet services, telecommunications, and other industries, with many exceeding 2 billion packets per second or 3 terabits per second. The largest reached 3.8 Tbps, which Cloudflare described as the largest publicly disclosed DDoS attack at the time. Predominantly UDP traffic attempted to saturate network bandwidth and exhaust processing resources.
The traffic apparently originated from compromised MikroTik devices, DVRs, web servers, and ASUS home routers. Cloudflare suspected attackers had exploited a recently disclosed ASUS vulnerability rated 9.8, but did not identify its CVE. Censys separately highlighted an improper-authentication vulnerability in ASUS routers; the available information does not establish whether it was the flaw used in this campaign. Cloudflare said its global anycast network distributed attack traffic while autonomous packet-filtering systems generated real-time mitigation rules, preventing customer performance impacts. Organizations should prioritize router patching and verify that DDoS protection can withstand both bandwidth saturation and extreme packet rates.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
A separate attack against the same unnamed Cloudflare customer peaked at 2.14 billion packets per second and lasted 60 seconds. Cloudflare assessed that high-packet-rate attacks appeared to originate from compromised MikroTik devices, DVRs, and web servers operating together.
An attack against an unnamed Cloudflare customer peaked at 3.8 Tbps and lasted 65 seconds, making it the largest publicly disclosed DDoS attack at the time, according to Cloudflare. Cloudflare assessed that high-bitrate attacks in the campaign appeared to originate from compromised ASUS home routers.
A month-long campaign beginning in early September targeted Cloudflare customers in financial services, Internet services, telecommunications, and other industries. Cloudflare autonomously mitigated more than 100 Layer 3/4 attacks, many exceeding 2 billion packets per second or 3 Tbps; the source did not specify the year.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare successfully detected and mitigated the largest distributed denial-of-service (DDoS) attack on record, which peaked at 29.7 terabits per second and was attributed to the AISURU botnet. The attack, which lasted 69 seconds, utilized UDP carpet-bombing techniques targeting an average of 15,000 destination ports per second, and originated from a botnet-for-hire service leveraging between one and four million compromised routers and IoT devices worldwide. While the specific target of the attack was not disclosed, Cloudflare noted that the AISURU botnet has been responsible for a surge in hyper-volumetric DDoS attacks, particularly against telecommunications, gaming, hosting, and financial services sectors. AISURU's operations have resulted in over 2,800 attacks mitigated by Cloudflare since the start of the year, with nearly half classified as hyper-volumetric, exceeding 1 Tbps or 1 billion packets per second. The botnet's activity has not only set new records for DDoS attack volume but has also demonstrated the potential to disrupt internet service providers even when they are not the direct targets. The majority of attack sources have been traced to locations in Asia, and the overall frequency and scale of DDoS attacks have seen significant increases compared to previous quarters and years.
Jun 29, 2026
Cloudflare successfully mitigated the largest distributed denial-of-service (DDoS) attack ever recorded, which peaked at 22.2 terabits per second and 10.6 billion packets per second. The attack, which lasted approximately 40 seconds, was automatically detected and blocked by Cloudflare’s network without service disruption. This incident was twice the size of any previous DDoS attack seen on the internet, highlighting the increasing scale and frequency of such attacks. Cloudflare did not disclose the specific target of the attack but emphasized the importance of robust, automated DDoS mitigation capabilities for organizations. The event underscores the ongoing escalation in DDoS attack volumes and the need for advanced protection measures.
Jun 29, 2026
Cloudflare said it mitigated **23.2 million network-layer DDoS attacks** and **29.64 trillion** malicious HTTP requests in the first half of 2026, with April marking the peak of activity. The sharpest growth came from hyper-volumetric attacks: **935 network-layer attacks exceeded 1 Tbps** in H1, including **805 in Q2**, up from about 130 in Q1. The company said attackers increasingly shifted from traditional botnet floods to **reflection and amplification** methods, with **DNS-based attacks** becoming the leading network-layer vector and **CLDAP floods** rising 580 percent quarter over quarter to become the third most common vector in Q2. Cloudflare linked the wave to geopolitical flashpoints and major events, saying **media, production, and publishing** became the most targeted sector as attackers sought to disrupt reporting and suppress information around the wars involving Ukraine and Iran and the FIFA World Cup. Government entities also saw increased targeting following the US-Israeli operation against Iran, while the US, China, and Turkey ranked among the most-targeted regions, including elevated attacks around the Ankara NATO Summit. Cloudflare said DDoS activity declined after April and suggested the drop may be tied to **Operation PowerOFF**, a multinational law-enforcement crackdown on DDoS-for-hire services.
Aug 18, 2026