Hyper-volumetric IoT botnets rewrite enterprise resilience rules - IoT News

Cybersecurity & Risk,Features,Networking,Research,Security, Privacy & Compliance

Ryan Daws

4th December 2025

Share this story:

Tags:

Categories::

Hyper-volumetric IoT botnets have become a primary operational risk and new rules are required to maintain enterprise resilience.

Cloudflaredata from the third quarter of 2025 indicates that the weaponisation of compromised connected devices has reached unprecedented levels, rendering traditional manual intervention and on-premise mitigation hardware obsolete.

The threat landscape is no longer defined merely by the sophistication of an attack, but by its sheer brute force. The third quarter was dominated by the emergence of the Aisuru botnet, a network comprising an estimated 1-4 million infected hosts globally.

Aisuru – with its massive consolidation of compromised endpoints, likely composed of unsecured IoT devices and residential routers – routinely unleashed attacks exceeding 1 terabit per second (Tbps) and 1 billion packets per second (Bpps).

Attacks peaked at a record-breaking 29.7 Tbps and 14.1 Bpps. To contextualise this volume: this is not traffic that can be filtered by a standard data centre firewall.

The record-breaking incident was a UDP carpet-bombing attack that bombarded an average of 15,000 destination ports per second. While it lasted only 69 seconds, such bursts are capable of saturating upstream internet links to effectively silence an organisation’s digital presence before internal security teams receive an alert.

The targets of these hyper-volumetric IoT botnets reveal a troubling convergence of geopolitical tension and industrial sabotage. It is no longer primarily gaming servers or financial institutions in the crosshairs.

Escalating EU-China trade tensions over rare earth minerals coincided with a sharp rise in attacks against the mining, minerals, and metals industry. Similar tensions over EV tariffs also coincided with a rise in attacks against the automotive sector during Q3.

In fact, the automotive industry saw the largest surge, leaping 62 spots in the rankings to become the sixth most attacked industry globally. The mining, minerals, and metals sector climbed 24 spots.

This correlation suggests that Distributed Denial of Service (DDoS) capabilities are being deployed as asymmetric levers in trade disputes. For businesses, this underscores the reality that cyber enterprise resilience is now intrinsically linked to geopolitical risk.

Beyond industrial targets, the AI sector faces mounting pressure. Attack traffic against AI companies surged by as much as 347 percent month-over-month in September 2025. This spike aligns with growing public and regulatory scrutiny; for instance, the UK Law Commission launched a review into AI use in government during the same period.

For enterprises integrating generative AI into their products, this volatility presents a reliability concern. If the API providers underpinning these services are subject to constant hyper-volumetric bombardment, downstream availability for enterprise applications becomes fragile.

Traffic sources often correlate with regions experiencing rapid digital adoption but uneven security governance. Indonesia, for example, has been identified as the largest source of DDoS attacks for a full year.

Since late 2021, the percentage of HTTP attack requests originating from Indonesia has increased by 31,900 percent. This gargantuan statistic highlights the dangers of unsecured digital infrastructure in emerging markets, where vast fleets of IoT devices can be co-opted into botnets like Aisuru without the device owners’ knowledge.

The velocity of modern attacks creates the primary operational resilience challenge for enterprise IT leaders. Cloudflare data indicates that 89 percent of network-layer attacks and 71 percent of HTTP attacks conclude in under 10 minutes. In many cases, the attack duration is shorter than the time required for a human analyst to log into a dashboard.

This “hit-and-run” methodology is particularly damaging. A short attack may only last a few seconds, but the disruption it causes can be severe, and recovery takes far longer. Operational teams are frequently left with a complex multi-step process to restore systems, verify data consistency across distributed databases, and reassure customers to minimise reputational damage.

Legacy mitigation strategies, such as on-demand scrubbing centres or manual route injection, are ill-suited for this environment. By the time traffic is diverted to a scrubbing facility, the attack may already be over, having successfully disrupted the session state or backend processing. As Cloudflare notes, “that’s too fast for any human or on-demand service to react.”

The barrier to entry for launching these attacks remains low. “Chunks” of the Aisuru botnet are offered by distributors as botnets-for-hire. This allows malicious actors to inflict chaos on backbone networks and saturate internet links for a cost of merely