A massive distributed denial-of-service (DDoS) assault reaching an unprecedented peak of 31.4 terabits per second (Tbps) has been attributed to the AISURU/Kimwolf botnet. The attack, which lasted just 35 seconds, is now being described as one of the largest hyper-volumetric DDoS events ever recorded.
Cloudflare said it automatically identified and blocked the activity, noting that the incident was part of a wider surge in hyper-volumetric HTTP DDoS attacks linked to AISURU/Kimwolf during the fourth quarter of 2025. The specific attack occurred in November 2025.
The botnet has also been associated with a separate campaign dubbed The Night Before Christmas, which began on December 19, 2025. According to Cloudflare, attacks observed during this campaign averaged 3 billion packets per second (Bpps), 4 Tbps, and 54 million requests per second (Mrps). At their peak, the attacks escalated to 9 Bpps, 24 Tbps, and 205 Mrps.
"DDoS attacks surged by 121% in 2025, reaching an average of 5,376 attacks automatically mitigated every hour," Cloudflare's Omer Yoachimik and Jorge Pacheco said. "In 2025, the total number of DDoS attacks more than doubled to an incredible 47.1 million."
The web infrastructure firm reported mitigating 34.4 million network-layer DDoS attacks throughout 2025, a sharp increase from 11.4 million in 2024. In the final quarter of 2025 alone, network-layer incidents represented 78% of all DDoS activity. Overall, DDoS attacks climbed 31% quarter-over-quarter and rose 58% compared to the previous year.
Hyper-volumetric DDoS attacks also saw a significant rise, increasing by 40% in Q4 2025 compared to the previous quarter, jumping from 1,304 to 1,824 incidents. Earlier in the year, Q1 2025 recorded 717 such attacks. Alongside the growing frequency, the scale of these attacks expanded dramatically, with sizes increasing by more than 700% compared to large-scale incidents observed in late 2024.
AISURU/Kimwolf is believed to have compromised over 2 million Android devices, largely unbranded Android TVs, which were absorbed into its botnet. Many of these infections were facilitated through residential proxy networks such as IPIDEA. In response, Google recently disrupted the proxy service and initiated legal action to dismantle dozens of domains used to manage infected devices and route proxy traffic.
Google also collaborated with Cloudflare to interfere with IPIDEA’s domain resolution capabilities, significantly weakening the operators’ command-and-control infrastructure.
“As part of the Google-led disruption effort, Cloudflare participated by suspending access to many accounts and domains that were misusing its infrastructure," Cloudflare told The Hacker News over email. "Threat actors were attempting to distribute malware and provide markets for people seeking access to the network of illicit residential proxies."
Investigations suggest that IPIDEA recruited infected devices using at least 600 malicious Android applications embedded with proxy SDKs, along with more than 3,000 trojanized Windows executables masquerading as OneDriveSync tools or Windows updates. The Beijing-based firm has also promoted VPN and proxy applications that covertly transformed users’ Android devices into proxy exit nodes without their awareness or permission.
Additionally, threat actors have been identified operating more than a dozen residential proxy services posing as legitimate businesses. These offerings, despite appearing separate, are all reportedly connected to a centralized infrastructure controlled by IPIDEA.
Cloudflare highlighted several additional trends observed during Q4 2025. Telecommunications companies, service providers, and carriers were the most targeted industries, followed by IT services, gambling, gaming, and software sectors. The most attacked countries included China, Hong Kong, Germany, Brazil, the United States, the United Kingdom, Vietnam, Azerbaijan, India, and Singapore.
Bangladesh overtook Indonesia as the largest source of DDoS traffic globally, with Ecuador, Indonesia, Argentina, Hong Kong, Ukraine, Vietnam, Taiwan, Singapore, and Peru also ranking among the top origins of attack traffic.
"DDoS attacks are rapidly growing in sophistication and size, surpassing what was previously imaginable," Cloudflare said. "This evolving threat landscape presents a significant challenge for many organizations to keep pace. Organizations currently relying on on-premise mitigation appliances or on-demand scrubbing centers may benefit from re-evaluating their defense strategy."