Aisuru, KimWolf Botnets Disrupted in International Operation

U.S. authorities seized the attack infrastructure responsible for the largest distributed denial of service attack yet recorded in an international police operation that swept up servers underpinning four botnets.

See Also: Free Your IT Program of Tech Debt With an Enterprise Browser (eBook)

The KimWolf botnet, likely with the assistance of the Aisuru botnet, in December 2025 launched an attack against content delivery network Cloudflare that reached 31.4 terabits per seconds.

U.S. federal authorities obtained a March 16 search warrant to seize virtual servers and domains used by KimWolf and Aisuru, as well as lesser botnets known as JackSkid and Mossad, which has no relation to the Israeli intelligence service.

The botnets are variants of the Mirai wormable botnet, infamous for a decade of wrangling exposed devices into botnets for DDoS attacks and cryptojacking. Numerous versions exist thanks to an anonymous coder who leaked source code online before its three original authors pleaded guilty in 2017.

Administrators behind the four targeted botnets offered access on cybercrime forums for a fee, whether for launching DDoS attacks or using infected devices as local proxies. As part of the operation, German and Canadian police searched homes and seized cryptocurrency. An affidavit cites evidence tying KimWolf administrators to British Columbia and Quebec in Canada and the city of Hanover in Germany. Police did not announce any arrests.

The KimWolf botnet has drawn heavy attention since its inception last fall, not least for its novel technique of hacking already compromised Android TV top boxes used as residential proxies. KimWolf operators used the boxes as a launching pad for converting even more devices on a local network into bots. Industry executives told federal investigator Elliott Peterson – also the principal agent for U.S. investigations into the Mirai botnet – that KimWolf has infected between 3 to 5 million devices. (see: ISP Sinkholes Kimwolf Servers Amid Eruption of Bot Traffic).

KimWolf and Aisuru were almost certainly part of the same cybercrime group concluded Chinese cybersecurity firm Xlab in December. Peterson cited evidence that KimWolf and Aisuru, as well as the Mossad botnet, were created with the involvement of a young German hacker nicknamed “Snow” or “Lucy,” whose real first name may be Philip. Mossad appears to be a solo undertaking by the German hacker, who apparently in January 2025 wrote in a Telegram channel dedicated to DDoS services that “two my Canadian friends betrayed me.”

Peterson is an agent for the Defense Criminal Investigative Service, a criminal arm of the Pentagon office of the inspector general; previously he worked for the FBI as a computer intrusion investigator.

The Aisuru botnet is notable for commandeering digital video recorders into its botnets. Cloudflare attributes a series of late December DDoS attacks against that it dubbed “The Night Before Christmas” to a combination of Aisuru and KimWolf, although Peterson told a federal judge he’s unsure. “Whether this attack was launched only by devices infected with the KimWolf botnet, or an aggregation of multiple botnets, including KimWolf and Aisuru, remains to be seen,” he wrote.

The attacks obtained a top rate of 205 million requests per second, a rate “comparable to the combined populations of the U.K., Germany and Spain all simultaneously typing a website address and then hitting ‘enter’ at the same second,” Cloudflare wrote.

Cloudflare has written that Aisuru and KimWolf operators appear to avoid attacks on government and military targets, likely in a bid to avoid attracting police attention. But Peterson wrote in his affidavit that all four targeted botnets have launched DDoS attacks targeting IP addresses that are part of U.S. military global network, known as the Department of Defense Information Network.

Even had the botnets not targeted the DoDIN, avoiding official targets likely wouldn’t have succeeded as a strategy for avoiding a takedown – as a slew of previous law enforcement actions have shown (see: Feds Seize Domains in Global Proxy Botnet Crackdown).

Still, takedowns come and takedowns go, and there’s almost a new cybercriminal willing to attempt a living from selling proxies and DDoS.

With reporting by Information Security Media Group’s Rashmi Ramesh in Bengaluru, India.