Cloudflare has successfully mitigated the largest distributed denial-of-service (DDoS) attack ever recorded, peaking at 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps).
The massive attack lasted only 40 seconds but generated traffic levels equal to streaming one million 4K videos simultaneously.
DDoS attacks overwhelm system or network resources, slowing or shutting down services for legitimate users. The scale of this attack was particularly difficult to handle due to the packet rate, which Cloudflare estimated as the equivalent of every person on the planet refreshing a web page 1.3 times per second. Such high packet volumes can overwhelm firewalls, routers, and load balancers, even if the total bandwidth seems manageable.
This record follows a string of massive attacks against Cloudflare in recent months. Just three weeks ago, the company reported mitigating an 11.5 Tbps and 5.1 Bpps attack, previously the largest publicly disclosed. Two months earlier, Cloudflare defended against a 7.3 Tbps attack. In April, the company warned it was seeing record levels of DDoS activity in 2025.
While Cloudflare has not confirmed the source of the most recent incident, researchers from Qi’anxin’s XLab attributed the 11.5 Tbps attack to the AISURU botnet. AISURU has infected more than 300,000 devices globally and surged in activity after the compromise of a Totolink router firmware server in April 2025.
The botnet also exploits vulnerabilities in IP cameras, DVRs/NVRs, Realtek chips, and routers from T-Mobile, Zyxel, D-Link, and Linksys.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
