Aisuru Botnet Shifts from DDoS to Residential Proxies
Summary: Aisuru, a botnet first identified in August 2024 that has spread to at least 700,000 IoT systems such as routers and security cameras, was overhauled to rent its infected devices to residential proxy services that anonymize cybercriminal traffic. The botnet previously drove record DDoS attacks, including a 6.3 Tbps hit on KrebsOnSecurity.com in June and demonstrations of nearly 30 Tbps, and Netscout's Roland Dobbins reported outbound attack traffic exceeding 1 Tb/sec from compromised customer premises equipment caused significant disruption to broadband access networks and chassis-based router line card failures.
What you should know: Spur tracked 250 million unique residential proxy IPs in 90 days, and Synthient found a one-to-one match between one proxy seller's pool and IP addresses previously mapped to Aisuru - meaning hundreds of thousands of compromised devices on your network may now be rented out to hide someone else's traffic.
Read the original at Krebs on Security ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026