Microsoft Azure Withstands Unprecedented 15.72 Tbps DDoS Onslaught From IoT Botnet Aisuru

On 24 October 2025, Azure—the cloud computing arm of Microsoft—came under a floor-shaking attack: a distributed-denial-of-service (DDoS) campaign measuring 15.72 terabits per second (Tbps) and nearly 3.64 billion packets per second (pps) , aimed at a single public IP address hosted in Australia. Microsoft confirms the assault was launched by the botnet known as Aisuru—a rapidly evolving “Turbo Mirai”-class network of compromised Internet-of-Things (IoT) devices.

The magnitude of the flood itself is what made headlines. According to Microsoft, the attack:

Utilised over 500,000 unique source IP addresses. Took the form of high-rate UDP packet floods, targeting a single public endpoint. T Exhibited almost no source-address spoofing, and employed randomized source ports—a technique which ironically eased traceback by network providers.

Microsoft’s blog post emphasised that Azure’s global DDoS mitigation infrastructure engaged automatically, routing, filtering and suppressing the traffic to ensure no visible disruption to the customer workloads.

The Aisuru botnet is part of a new generation of IoT-based attack platforms. Security firm Netscout describes it as a Turbo Mirai-class botnet, meaning it builds on the blueprint of the famous Mirai malware but pushes far higher bandwidth and packet-throughput capabilities.

Key characteristics of Aisuru include:

A focus on infecting consumer-grade devices: routers, IP-cameras, DVR/NVR systems. A recruitment spike in early 2025, notably via a compromised firmware update server of one router vendor (TotoLink), which reportedly added ~100,000 devices to its arsenal. Unlike some botnets that rely heavily on IP-spoofing and reflection/amplification, Aisuru appears to generate direct-path traffic from infected devices: the source IPs are real (rather than spoofed), which means defenders can trace back to the infected devices and network providers.

In simple terms: the IoT devices themselves—planted inside consumer networks—become massive cannon-barrels, firing traffic at a victim endpoint, as opposed to hiding behind reflection/amplification networks.

While the Azure incident is the most visible, it is far from the only major campaign by Aisuru. Some recent findings:

In September 2025, Chinese cybersecurity firm Qi’anxin XLab attributed an 11.5 Tbps DDoS attack to Aisuru, estimating around 300,000 bots in operation at the time. In October, U.S.-based ISPs reportedly logged outbound traffic surges from Aisuru-infected devices that peaked near 29.6 Tbps. Netscout’s October summary warned that Aisuru-class botnets are launching attacks exceeding 20 Tbps and 4 billion pps, and causing line-card failures in network hardware.

This progression shows not only growth in size, but also in complexity—and in risk to network operators themselves (particularly ISPs hosting the infected devices).

Cloud providers under siege. The attack on Azure confirms that even major cloud platforms are targets—and that volumetric attacks are scaling faster than ever. The fact that a single endpoint was targeted highlights how individual assets can attract massive campaigns.

IoT perimeter weaknesses persist. Aisuru’s strength comes from devices that are poorly secured, often consumer-grade, and poorly maintained. Each one becomes a launch-pad for multi-terabit attacks.

Outbound/cross-network threats. With so many infected nodes inside ISP networks, the threat is not just inbound (i.e., attacks against a provider) but outbound : infected devices launch attacks from within the provider’s network, risking collateral damage and service degradation for other customers.

Mitigation strategies must evolve. As Aisuru demonstrates, mitigation is not just absorbing traffic; it requires traceback , device remediation , network-edge filtering , and collaboration with ISPs. Netscout emphasises that because traffic isn’t spoofed, defenders have leverage—but only if they act quickly.

DDoS magnitude thresholds keep rising. What was once extreme (5-10 Tbps) is now being exceeded. The Azure event at 15.72 Tbps may soon seem «routine» in the arms-race of DDoS.

Expansion of botnet-as-a-service (BaaS) models. Aisuru’s operators appear to provide infrastructure for hire—meaning wider access to heavy fire-power for malicious actors. Security researchers expect this business model to grow. Greater focus on remediation of consumer devices. The weak link remains broad; every router/camera with default credentials or unpatched firmware is a potential node. Network operator collaboration. ISPs and cloud providers must increasingly threat intelligence and coordinate filters, especially when infected devices are inside their infrastructure. Hardware consequences. As line-cards and router back-planes are being stressed by these enormous floods, hardware failure becomes part of the threat vector—taking out infrastructure not just by traffic overload, but by destabilising operational hardware. Legal/regulatory implications. Governments and regulators may increasingly demand IoT manufacturers implement stronger baseline security, given the systemic risk posed by large-scale botnets.

At its core, Aisuru has operated as a DDoS-for-hire platform: an infrastructure of compromised devices that can be hired (directly or indirectly) to launch large-scale attacks on third-party targets. Security firm Netscout describes Aisuru as “operates as a DDoS-for-hire service with restricted clientele” and equipped to generate “multi-Tb/sec and 4 gpps+” attacks. According to research by Qi’anxin XLab, the botnet’s operators showcased attacks and advertised its capabilities in service of attracting clients.

More recently, there has been a shift (or expansion) in the revenue model: Aisuru is reportedly offering “residential proxy” services by leveraging its large pool of globally-distributed infected Internet-of-Things (IoT) devices. These devices act as exit-points for traffic, enabling paying clients to route Internet requests through seemingly legitimate residential IP addresses.

In a recent article on the Aisuru Botnet by Brain Krebs:

Read complete Krebs article HERE

The botnet’s “inventory” of compromised devices is central to its value. Aisuru recruits large numbers of IoT devices — routers, DVRs/NVRs, IP-cameras, other consumer-grade devices with weak security. For example, XLab reports that Aisuru exploited a firmware-update server (for a router vendor) and added ~100,000 devices in a single event.

Netscout’s summary notes that Aisuru appears to restrict its targets: “with restricted clientele; operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national-security properties.”

This suggests that the business model includes self-imposed “rules of engagement” to avoid drawing excessive law-enforcement attention, thereby preserving the service’s viability.

The C2 infrastructure of Aisuru/AIRASHI is fairly sophisticated. From XLab’s analysis:

The botnet uses a custom communication protocol: login packets, heartbeat messages, commands (attack, execute.cmd, new C2, proxy), encrypted using e.g., ChaCha20, with HMAC verification and other anti-analysis features. The login packet structure includes fields like bot-ID, version, node name, kernel version, support for UDP flooding etc. Message types observed include:

“attack” – issue DDoS command

“proxy” – enable the node as a proxy

“report telnet scan” / “killer” / “netspeed” – suggest internal telemetry and maintenance tasks.

This indicates the botnet is not just a “fire-and-forget” DDoS handler: it has capabilities for remote commands, maintenance, node management, and expansion of business services (proxy usage).

The network of C2 endpoints is global and distributed, partly to avoid takedown and tracing. XLab notes that one variant (AIRASHI) had domains resolving to 144 IPs across 19 countries and 10 ASNs.

Some specific C2 domain names reported: xlabsecurity.ru, foxthreatnointel, among others. The domain naming sometimes mocks security researchers (indicating intention and boldness).

The overall workflow can be described as:

Infection/Recruitment : IoT devices are compromised via exploits (zero-day or known vulnerabilities) or default/weak credentials. For example, XLab lists many CVEs used by Aisuru variants. Join Botnet / Call : Once infected, the device initiates with C2 (login packets, handshake). Receive Commands : The node receives instructions — to begin DDoS (attack), to switch to proxy mode, to report telemetry, to update malware, to kill competing malware, etc. Execute Payload : For DDoS: node sends high-volume/high-throughput traffic as directed. For proxy services: node opens proxy ports/relays connection. Telemetry & Maintenance : The C2 may gather reports (report telnet scan, report killer, etc) to monitor node health, performance, propagation, or clean competing infections. Adaptation : C2 may rotate attack vectors (UDP, TCP, GRE floods), randomize source ports, pseudo-random TCP flag combos, and optimize payload sizes for different targets. Netscout details this HERE

Several techniques make Aisuru harder to dismantle:

No source-spoofing (most attacks are direct-path) which means compromised devices’ real IPs are used – while easier for tracebacks, it may reduce some detection noise. Encryption of communication between bots and C2 (ChaCha20, HMAC) prevents simple packet signature detection. Distributed, multi-country, multi-ASN infrastructure for C2 endpoints. Frequent updates and variants (for example, from Aisuru → kitty → AIRASHI) indicate active evolution.

The shift into residential proxy services means the botnet is monetizing in a more sustainable way — the “renting” of infected devices is less flashy than mega-DDoS but potentially more profitable and less immediately visible. Mitigation must handle both inbound and outbound/cross-bound traffic: many infected devices reside inside ISP networks and launch attacks externally, putting the burden partly on access-network operators. Because C2 is distributed, defenses benefit from intelligence sharing across ISPs and security firms to identify C2 domains/IPs, track propagation, and coordinate sinkholing. A robust patch-management and credential-hygiene program for IoT devices (routers, cameras, DVRs etc) remains foundational: recruitment remains the weakest link. For enterprises/cloud providers: the scale (multi-Tbps) and speed (billions of packets per second) of these attacks push mitigation architectures to the limit — large scale scrubbing, edge detection, distributed mitigation are required.

The incident marks a watershed moment in the DDoS landscape: the size of the attack (15.72 Tbps) and the fact that a major cloud provider (Azure) successfully absorbed it without downtime suggest both how far the threat has advanced—and how far mitigation must evolve. It underscores that the Internet of Things is not just a convenience for consumers; in aggregate, it has become a weapon system of unprecedented power. For cloud providers, ISPs, enterprises and device-manufacturers alike, the message is clear: the defensive perimeter must extend deeper and further—into homes, into routers, into cameras—and be taken seriously.