DoJ Disrupts 3 Million-Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks

The U.S. DoJ disrupted C2 infrastructure of four IoT botnets (AISURU, Kimwolf, JackSkid, Mossad) responsible for record-breaking DDoS attacks reaching 31.4 Tbps.

• •The four botnets collectively infected over 3 million devices including Android TVs, DVRs, web cameras, and Wi-Fi routers worldwide.
• •AISURU/Kimwolf launched a 31.4 Tbps DDoS attack in November 2025 lasting only 35 seconds, with attacks also averaging 3 billion packets per second.
• •Kimwolf used a novel attack vector by infiltrating residential proxy networks through compromised IoT devices to access home networks protected by routers.
• •Operators ran a "cybercrime as a service" model selling access to infected devices; AISURU issued over 200,000 DDoS commands, JackSkid over 90,000.
• •