Hackers recently unleashed a ‘company killing’ DDoS attack, in what security researchers warned could be a test run for a colossal new Internet of Things (IoT) botnet capable of ‘crippling digital assaults’. 

Targeting the website of cybersecurity investigator Brian Krebs, the distributed denial-of-service attack was measured at 6.3 terabits of data per second (Tbps), ten times the size of the Mirai IoT botnet from 2016, which experts at the time called the largest cyber-attack of its kind in history after causing global outages.

Krebs said that this latest record breaking attack bore the same hallmarks as earlier incidents, linking it to the Aisuru botnet, first uncovered in August last year by researchers at QiAnXin XLab, after targeting a major gaming platform. 

The group behind Aisuru has been openly marketing its high-powered DDoS capabilities, capable of launching attacks reaching two terabits per second.

With this new DDoS attack, threat actors have upped their game. Although lasting for less than a minute, Krebs website was hit by large UDP packets at a rate of around 585 million data packets per second.

The cyber-attack against Krebs is even larger than the one fended off by Cloudflare late last year, which reportedly hit 5.6 Tbps with the culprit identified as another Mirai-variant botnet.

A Google security engineer working on the service that protects KrebsOnSecurity from DDoS attacks said these incidents all share clear similarities, suggesting they may be intended as a demonstration of the DDoS engine’s power.

“DDoS attacks of such magnitude and brevity typically are produced when botnet operators wish to test or demonstrate their firepower for the benefit of potential buyers,” claimed Krebs.

The past few years have seen a sharp increase in the number of DDoS-for-hire platforms, which allow sophisticated botnets to be ‘rented out’ to other hackers, with Micorsoft’s Digital Defence Report from 2023 identifying a striking 20% rise in these services over just one year.   

Recommended reading

• DDoS Attacks Surge 2,844% in Conflict Zones, Report Claims
• 2024 Saw the Biggest DDoS Attack On Record, Says Cloudflare
• DDoS Attacks Surged 56% in H2 2024

These can see attackers purchase DDoS capabilities for as little as $5, although prices increase in line with larger, more sophisticated assaults. For instance, the Aisuru botnet linked to the Krebs site has recently been offered at prices of around $150 per day on public Telegram channels.

This proliferation of DDoS-as-a-Service is fuelling a growing wave of cyber-attacks. Recent numbers from Netscout show that March saw more than 27,000 botnet-driven denial-of-service attacks, with threat actors able to launch smarter, longer-lasting campaigns hitting service providers with an average of one attack every two minutes.

Law enforcement agencies around the world are doing what they can, however, with Europol having shut down 27 of the most popular DDoS platforms last year and Polish authorities more recently arresting four individuals who allegedly ran a network of platforms used to launch thousands of cyber-attacks worldwide.

Don’t Miss Scotland’s Biggest Tech Event!

Join us at DIGIT Expo West on 5th June at the SEC Glasgow. Get leading industry insights across AI, Cyber Security, and Data, and grow your network at Scotland’s largest gathering of tech leaders – with 1500+ attendees, 50+ speakers, and 50+ exhibitors.

Register your FREE place now at www.digitexpowest.com