Aisuru botnet drives 33% of DDoS traffic on Arelion backbone

A single botnet has become the dominant source of distributed denial-of-service (DDoS) traffic on one of the world’s largest internet backbones. Arelion’s latest report reveals that the Aisuru botnet generated approximately one-third of the DDoS traffic observed on its AS1299 network, underscoring how compromised consumer devices are reshaping the economics of network security for infrastructure providers.

What the report shows

Arelion’s data, published this week, indicates that Aisuru accounted for 33% of DDoS traffic on its backbone. The botnet has assembled over 500,000 infected devices, primarily consisting of Internet of Things (IoT) gadgets and Android-based systems. Attack volumes have reached multi-terabit levels, with shorter, more intense campaigns becoming increasingly difficult to mitigate. The concentration of traffic from a single source is unusual, according to the carrier, and reflects a shift in how botnets are being deployed at scale.

The report does not provide a global estimate but focuses on traffic crossing Arelion’s AS1299 network. While the carrier operates a major backbone, the findings are specific to its infrastructure and may not reflect broader trends across other networks or regions. A related botnet, KimWolf, was also mentioned in the report but did not approach Aisuru’s scale in the observed data.

Why the scale matters

The economic impact of DDoS attacks has long been a concern for carriers and cloud providers, but the concentration of traffic from a single botnet introduces new challenges. Traditional mitigation strategies rely on distributing attack traffic across multiple scrubbing centers, but the sheer volume and intensity of Aisuru-driven attacks are straining these defenses. Arelion’s report notes that shorter, more frequent campaigns are harder to contain, increasing operational costs for providers and potentially raising prices for enterprise customers.

The use of consumer devices as attack vectors also complicates mitigation efforts. Unlike data center-based botnets, which can be isolated or blocked at the source, IoT and Android devices are widely dispersed and often lack robust security updates. This makes them persistent threats, as reinfection rates remain high even after initial cleanup efforts. The report suggests that the botnet’s operators are leveraging these vulnerabilities to maintain a large, resilient pool of compromised devices.

What to watch

The report highlights a broader trend in cybersecurity: the increasing sophistication of botnet operations and their ability to exploit consumer-grade hardware. For infrastructure providers, this means investing in more scalable mitigation tools and collaborating across networks to share threat intelligence. Enterprises, particularly those reliant on cloud services or edge computing, may need to reassess their DDoS protection strategies to account for the rising intensity of attacks.

Arelion’s findings also raise questions about the long-term sustainability of current network defense models. If a single botnet can dominate traffic on a major backbone, the industry may need to explore new approaches to traffic filtering, device security, and cross-provider coordination. The report does not propose specific solutions but underscores the urgency of addressing these challenges as attack volumes continue to grow.