Microsoft fends off largest DDoS attack in history on Azure

Azure has just been targeted by the largest cloud-based distributed denial of service (DDoS) attack ever, with traffic reaching 15.72 terabits per second (Tbps), originating from the Aisuru botnet, according to Microsoft.

On October 24, the Windows giant's cloud-based DDoS protection service automatically detected and successfully blocked a "tsunami" of traffic — nearly 3.64 billion packets per second — ensuring no customers experienced service disruption, Microsoft's Sean Whalen said in a blog post on Monday.

Microsoft said it has successfully fended off the largest DDoS attack in history targeting its Azure cloud platform.

More than 500,000 source IP addresses from multiple regions simultaneously attacked a single endpoint with UDP packets in this DDoS event, Whalen added.

“This is the largest cloud DDoS attack ever recorded and it targeted a single endpoint in Australia,” Whalen wrote, confirming that the Aisuru botnet was responsible for the cyberattack.

Aisuru is a new IoT botnet, based on the Mirai source code, that has been responsible for several record-breaking DDoS attacks since its emergence in August 2024. Among them was a June 2025 attack on KrebsOnSecurity that generated 6.3 Tbps of traffic – according to cybersecurity journalist Brian Krebs, it was the largest attack Google had ever prevented at the time.

By October, Aisuru operators had upgraded their attack capabilities to exceed 20 Tbps, according to Netscout chief engineer Roland Dobbins.

The botnet primarily infects home routers and cameras on residential internet service provider networks. Despite operating as a DDoS-for-hire model, Mr. Dobbins said Aisuru's operators "are believed to have taken precautions to avoid targeting government , law enforcement, military, and other national security targets." However, given that this is a criminal organization, this information should be taken with a grain of salt.

The attack is believed to have been carried out by the operator of the Aisuru botnet.

Earlier this month, Cloudflare reportedly removed Aisuru-related domains from its Top Domains rankings after they surpassed Amazon, Apple, Google, and Microsoft in the list of most visited websites.

"The attacker simply generated a large number of requests, possibly intended to influence the rankings, and also attacked our DNS service," Cloudflare CEO Matthew Prince told KrebsOnSecurity at the time. "We are adjusting the rankings to be smarter. In the meantime, we will hide any sites that are classified as malware."

While the attack that Azure blocked may have been the largest ever, it's only a matter of time before Aisuru operators or another group breaks this DDoS record. As Whalen notes, "Attackers are scaling with the growth of the internet itself."

In Cloudflare's most recent quarterly DDoS report, the company noted that the number of attacks in the second quarter of 2025 increased by more than 40% compared to the same period last year.