Cloudflare Mitigates Record 29.7 Tbps DDoS Attack

Cloudflare, a leading web performance and security firm, successfully mitigated the largest distributed denial-of-service (DDoS) attack ever recorded on Wednesday, peaking at 29.7 terabits per second (Tbps) and 14.1 billion packets per second (Bpps). The assault, launched in the third quarter of 2025, originated from the Aisuru botnet and lasted 69 seconds, bombarding an average of 15,000 destination ports per second in a UDP carpetbombing technique designed to overwhelm targets.

The attack randomized packet attributes to bypass defenses, but Cloudflare's systems autonomously blocked it without disclosing the targeted organization. Aisuru, a Turbo Mirai-class botnet comprising between one and four million compromised Internet of Things (IoT) devices such as routers, CCTV cameras, and digital video recorders, has emerged as a prolific threat. Powered by these infected devices worldwide, the botnet operates on a DDoS-for-hire model, allowing customers to rent its capabilities for attacks or related services like residential proxying for spamming and data scraping. Access costs range from a few hundred to several thousand dollars, making it accessible to a wide range of actors.