If 2025 deserves a title, it's "the first year of the Terabit-per-second era." According to Cloudflare's 2025 annual DDoS Threat Report, the year saw 47.1 million attacks (double 2024; a 236% rise from 2023 to 2025), with an average of 5,376 attacks autonomously mitigated every hour. The central actor driving this was a hyper-scale botnet named Aisuru (and its Aisuru-Kimwolf variant). This article reads the "scale" and "economics" behind that report.

1. Aisuru: a million-node "botnet cloud"

Aisuru is estimated to comprise 1 to 4 million infected hosts, primarily Android TV boxes and HiSilicon-based IoT devices. The hyper-volumetric attacks it launches routinely exceed 1 Tbps and 1 billion packets per second (Bpps).

More unsettling is its rental economy: chunks of Aisuru are sold by distributors as Botnet-as-a-Service. For just a few hundred to a few thousand dollars, anyone can cripple a nation's backbone networks and cut millions of users off from essential services. Attack has become a fully commoditized product.

2. Records broken again and again

  • 2025 Q3: Aisuru launched the record 29.7 Tbps UDP carpet-bombing attack and 14.1 Bpps; a single attack randomized an average of ~15,000 destination ports per second.
  • 2025 Q4 (Dec 19, "The Night Before Christmas" campaign): HTTP DDoS against Cloudflare infrastructure and customers peaked at 205 million RPS.
  • Late 2025: one attack hit a staggering 31.4 Tbps in just 35 seconds—the largest attack traffic any company had publicly disclosed at the time.

How to grasp 205 Mrps? It's roughly the entire populations of the UK, Germany, and Spain each hitting Enter on a URL in the same single second.

3. An overlooked truth: collateral damage

How massive is Aisuru's traffic? Per Krebs on Security, merely routing through certain U.S. ISPs caused "widespread collateral Internet disruption in the U.S."—and those ISPs weren't even the targets. This is the most dangerous aspect of hyper-volumetric DDoS: when an attack can saturate a nation's backbone, the splash damage alone takes down third parties. Imagine that traffic aimed directly at an under-protected ISP, critical infrastructure, healthcare, or emergency services.

4. Where the attacks come from: cloud abuse

Cloudflare found the vast majority of attack traffic originated from IPs tied to cloud platforms: DigitalOcean, Microsoft, Tencent, Oracle, and Hetzner all appeared in the top-ten sources. It reveals an uncomfortable reality—threat actors are leveraging the world's most accessible, most powerful infrastructure (easily provisioned VMs) to generate huge traffic. A single attack commonly draws from thousands of distinct ASNs; the botnet nodes are genuinely global.

5. Why "human response" is no longer enough

A key figure from the report: 71% of HTTP DDoS and 89% of network-layer attacks ended within 10 minutes. A short attack may last seconds, yet the disruption and recovery cost far exceed its duration. When the attack is faster than any operator's reaction, autonomous mitigation stops being a "nice-to-have" and becomes a survival baseline.

6. Takeaways for defenders

  • You need a globally distributed architecture that can absorb Tbps: on-prem appliances or on-demand scrubbing centers are simply outclassed by 30-Tbps-class floods.
  • Hiding the origin IP is prerequisite: attackers bypass scrubbing and hit the real IP directly; origin IP concealment is step one.
  • Autonomous mitigation: identify and divert in seconds, not when someone clocks in.
  • Organizations relying on on-prem or on-demand scrubbing should re-evaluate—this is Cloudflare's direct recommendation in the report.

Conclusion

The 2025 data sends a clear signal: the scale and sophistication of DDoS have outrun our imagination. For any critical business, the question is no longer "will we be attacked?" but "when attacked, can we wash it away within seconds?" Keep DDoS Away isn't luck—it's a globally distributed, autonomously deciding shield.