The Most Powerful Ever? Inside the 11.5Tbps-Scale Mega Botnet AISURU

This XLab report documents the AISURU/AIRASHI IoT botnet responsible for record‑setting multi‑Tbps DDoS attacks, describing an April 2025 compromise of a Totolink firmware update server that helped scale the botnet to ~300,000 nodes, its C2 infrastructure (including GRE tunnels and TXT‑encoded entries), sample propagation via N‑day/0‑day exploits, a technical analysis of v1/v2 samples (anti‑analysis, modified RC4, custom protocol, proxy capabilities), and a set of IoCs for detection and mitigation.