16 ms·
Azure hit by 15 Tbps DDoS attack using 500k IP addresses
https://techcommunity.microsoft.com/blog/azureinfrastructureblog/defending-the-cloud-azure-neutralized-a-record-breaking-15-tbps-ddos-attack/4470422 https://techcommunity.microsoft.com/blog/azureinfrastructure...
- akarve 1y agothis link is now hammered because of cloudflare. hard day for the internets.
- ChrisArchitect 1y agoSource: https://techcommunity.microsoft.com/blog/azureinfrastructureblog/defending-the-cloud-azure-neutralized-a-record-breaking-15-tbps-ddos-attack/4470422 https://techcommunity.microsoft.com/blog/azureinfrastructure...
- dang 1y agoSwitched above. Thanks!
- shoddydoordesk 1y agoFWIW I think this is a bad practice. The Microsoft article reads like a corporate press release. The original link contained additional pertinent information and research which is good for discussion.
- dang 1y agoOK, I've swapped them back. Thanks! The principles here are clear: we prefer the best third-party article to corporate press releases*, but at the same time we don't want blogspam (i.e. ripoffs that don't add anything interesting). * https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=corporate%20press%20release%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...
- TZubiri 1y agoWe should make residential proxies illegal
- teeray 1y ago...and suddenly no one is allowed to VPN back through their home router.
- rjdj377dhabsn 1y agoHow would that be enforced?
- dongttebayo 1y agoWe really shouldn’t - this seems like perhaps one of the worst ideas one could propose in an era of rising authoritarian rule. Seems like a bad time to be putting silly restrictions on how folks route their traffic.
- jeroenhd 1y agoMaking them illegal seems far-fetched, but at this point something like email blacklists but for web services is becoming inevitable. At the moment, that's what Cloudflare is doing. They're just not obvious enough, leading to people on forums (and here) asking "why do I constantly need to fill out captchas to enter websites".
- drcongo 1y agoImagine how much of that traffic was just the bots following the endless redirects.
- siva7 1y agoThose redirects would crash Azure, i'm betting a grand
- dang 1y agoRelated. Others? Cloudflare scrubs Aisuru botnet from top domains list - https://news.ycombinator.com/item?id=45857836 https://news.ycombinator.com/item?id=45857836 - Nov 2025 (34 comments) Aisuru botnet shifts from DDoS to residential proxies - https://news.ycombinator.com/item?id=45741357 https://news.ycombinator.com/item?id=45741357 - Oct 2025 (59 comments) DDoS Botnet Aisuru Blankets US ISPs in Record DDoS - https://news.ycombinator.com/item?id=45574393 https://news.ycombinator.com/item?id=45574393 - Oct 2025 (142 comments)
- alpb 1y agoFunny enough just got an error trying to reach to the blog Proxy Error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request Reason: Error reading from remote server
- bluedino 1y agoIoT is just wave after wave of unsecure devices. There's gotta be a better way.
- rdtsc 1y agoThe "S" in IoT stands for "security".
- heresie-dabord 1y ago> There's gotta be a better way. Until then... There's gonna be a bigger wave.
- tclancy 1y agoYou’re gonna need a bigger boat.
- kachapopopow 1y agofun fact, part of the reason this botnet exists is because europe required the ability to install security updates unattended that you cannot disable and they compromised one of the servers that had the capability to push these updates compromising hundreds of thousands of routers.
- Razengan 1y agoWait when was this?? Did it fly under the news??
- 1y ago
- esafak 1y agoIs this Aisuru growing? How can it be dismantled?
- SLWW 1y agoYes. Only way is to secure your IoT devices/routers/cameras/etc.
- esafak 1y agoThrough personal responsibility? That is not scalable; look at how many compromised devices there are. We need a better solution as an industry.
- rollcat 1y agoYep. Manufacturers / distributors should be held responsible. Aligning the incentives is half the battle.
- qiqitori 1y agoYes, need to protect Azure from those evil manufacturers.
- catlikesshrimp 1y agoAzure AWS and cloudflare will survive, then everything else will pay them for protection; when all of the internet is captive, they will lobby for regulation to reduce the costs. It would be better to get the regulation set up before stronger gatekeepers are created
- fch42 1y agoA "do not connect to the cloud" physical flip switch on the IoT device is what I want. Where can I sign the petition for that?
- 1y ago
- dainiusse 1y ago/sarcasm Another ai crawler...
- m00x 1y agoAnthropic agent went a little haywire on the tool use
- supportengineer 1y agoI will never understand why there isn’t an international law enforcement agency with teeth, which can get rid of the bad actors.
- morkalork 1y agoI'm sure you could come up with at least few ideas why it hasn't happened
- trollbridge 1y agoI mean, America can’t do anything about scam phone calls aimed at seniors who forge caller ID of local hospitals.
- morkalork 1y agoCan't or won't?
- trollbridge 1y agoI’ve decided there isn’t a difference.
- lossyalgo 1y agoAs alluded to by morkalork, they definitely could if they wanted to, as the (most? of the) rest of the world doesn't seem to have this problem. As long as spammers keep paying telecoms & no law(s) forbidding this exist, it will continue. edit: grammar
- toast0 1y ago> As long as spammers keep paying telecoms & no law(s) forbidding this exist, it will continue. That's the trick. A lot of countries bill calls to cell phones at 10 cents a minute; in the US, calling is near zero cost. The US makes a great market for scammers to target because of low operating costs, penetration of globally usable payment cards, minimal language diversity. Of course, these scams are forbidden by law, but that doesn't change the economics. Very few scam shops get busted; especially when most of them run from outside the US. STIR/SHAKEN helps a bit, but not much... without a effective mechanism to report unwanted calls that leads to those callers being ejected from the network as well as ejecting providers that are unresponsive to reports, there's not really hope of progress.
- shoddydoordesk 1y ago> it suddenly ballooned in size in April 2025 after its operators breached a TotoLink router firmware update server and infected approximately 100,000 devices This is scary. Everyone lauds open source projects like OpenWRT but... who is watching their servers? I imagine you can't run an army of security people on donations and a shoestring budget. Does OpenWRT use digital signing to mitigate this?
- sam_lowry_ 1y agoThis is exactly why OpenWRT has no unattended updates by default )
- shoddydoordesk 1y agoYou are dismissing the seriousness of this. Their package manager is widely used. One would only need to compromise their build servers to wreak havoc. Didn't they have a vulnerability in their firmware download tool like a minute ago? The difference between OpenWRT and Linux distros is the amount of testing and visibility. OpenWRT is loaded on to residential devices and forgotten about, it doesn't have professional sysadmins babysitting it 24/7. Remember the xz backdoor was only discovered because some autist at Microsoft noticed a microsecond difference in performance testing.
- jacobgkau 1y agoI'm confused why you're so honed in on OpenWRT as a third-party open-source project here when the vulnerability you quoted (TotoLink) was the official firmware update server of a brand of devices. Is it "scary" to think about OpenWRT potentially getting hacked? If you get scared by theoretical possibilities in software, sure. Is it relevant? Not exactly. Are companies' official servers more secure than an open-source project's servers? In this case, apparently not.
- danudey 1y agoWhat's scary is that OpenWRT is a project created by people who wanted a better solution than what was out there, and are therefore largely driven by a desire to create a good product. Meanwhile, corporations are driven entirely by profit motive, so as long as it's more expensive to be vigilant about security than it is to be lax about it they will never improve. Until companies which produce (and do not update) vulnerable equipment are penalized (e.g. charged with criminal negligence) for DDoS attacks using their hardware then the open-source projects are going to continue to be far more trustworthy and less vulnerable than corporations which mass-produce the cheapest hardware they can and then designating it as obsolete and unsupported as fast as possible to force more updates.
- null_deref 1y agoI don’t mean to cast any doubt, but are those short articles the standard, or why was there almost no data provided?
- sva_ 1y agoI feel like posting the traffic output of the network might not be a great idea because they might do these attacks on purpose to market their network's capability.
- kachapopopow 1y agoit's an open secret at that point and the attacks are far larger than that are causing congestion world-wide from the time they wake up to the time they go to sleep.
- codexon 1y agoWhy wouldn't microsoft advertise this though? If they had the ability to take the attack and others might not, then it'll result in more customers for them.
- Y_Y 1y agoCui bono? There is a big (opportunity) cost to this kind of thing, How is this worthwhile for anyone? I assume that its's not just a competitor. Is it really worth <insert evil country>'s time to temporarily upset one of of three big cloud providers? Is there a ransom behind the scenes?
- kachapopopow 1y agonope, there's really no cost to it - they've been hitting with attacks double or even triple the size towards random minecraft hosts for months now.
- deleted 1y ago[deleted]
- imglorp 1y ago> it targeted a single endpoint in Australia. It would really help to understand why attack one endpoint with "the largest DDoS attack ever observed in the cloud". If it was important, it would be redundant in its CDN. Who paid for this attack and what did they gain?
- kachapopopow 1y agowe were getting hit with attacks like this daily at some point and were forced to use cloudflare magic transit it's pretty random and you shouldn't read too deep into it as nearly every anti-ddos solution, host and isp has been hit with this botnet by now.
- estearum 1y agobut why? For fun?
- kachapopopow 1y agoyep, there's no consistency to their actions - basically hit a target and keep it down for as long as possible causing heavy business loss. to my knowledge none of the target servers have ever received a ransom request.
- toast0 1y agoI used to run servers for a very popular service. I'm 99% sure people DDoSed our www for lolz and also to kick the tires on DDoS as a service vendors. We would get DDoS on a pretty regular basis, for exactly 90 seconds, +/- a few nodes that had bad clock sync and were 2 seconds off; which was exactly what you get from a free trial at DDoS as a service. I feel like we got a ransom request like once; but I can't remember if it actually corresponded to an attack, if it did, I don't think it was consequential. Thankfully, it was almost always targetted at our www servers, which were not important for our service. Very occasionally, we'd get hit on the machines that we actually ran our service on, but between the consistent DDoS on www, and our own self-inflicted DDoS from defects in the client code we wrote for our users, our service was well prepared... if the DDoS went over line rate for the server, our hosting provider would null route it [1], but otherwise, we could manage line rate of udp reflection or tcp syn floods and what have you. From what I could tell, most attackers didn't retarget to our other servers when one got null routed. [1] They did try a DDoS scrubbing service, but having our servers behind the scrubber was way worse than just null routing. Maybe the scrubbing could have been tuned, but as it was, it was better for us to just have the attacked servers lose connectivity to the public network.
- perfmode 1y agoA DDoS attack is often used to distract a company's security team. While the security staff is scrambling to get the website back online, the attackers use the chaos to conduct a more serious, stealthy attack.
- mihaaly 1y agoIt was interesting to read that the record breaking attack caused no glitch whatsoever in the service MS provides. Which is so slow normally that I start to wonder if that is a strategy, having headroom for these kind of situations, no-one realizes slowdown when it is already slow. ;) This is just a crazy thought, tangential to what are happening during an attack.
- manquer 1y agoor rather the slowness problems of MS has nothing to do with hardware or infrastructure limitations. You cannot just throw infra at a problem to mask poorly written code beyond a point.
- RajT88 1y agoThere are many things which run well on Azure - built by companies with good dev teams. https://trends.builtwith.com/websitelist/Microsoft-Azure https://trends.builtwith.com/websitelist/Microsoft-Azure Plenty of crappy websites on the list too.
- Aachen 1y agoI don't doubt there will have been sporadic examples of this, but what points to this "often" being the case? It seems like a tactic that wouldn't often pay off, since DDoS mitigation rarely involves relaxing security systems Mistakes can be made during reconfigurations but you'd have to catch those while the issue is still live. Sounds like an advanced threat actor and not the run of the mill ransomware people (not that they're necessarily unsophisticated, but why'd they bother with these odds when there's low-hanging fruit to reliably exploit)
- averageRoyalty 1y ago> This attack lasted only 40 seconds but was roughly equivalent to streaming one million 4K videos simultaneously. Who is this for? Is there anyone reading the article that can't grasp what a terrabit is but can somehow conceptualise one million 4k videos streaming simultaneously? I don't think anyone sits in that venn diagram.
- Hnrobert42 1y agoYeah. That falls in the same bin as number of Olympic swimming pools or distance to the moon. The best, meaningful comparison I've read is from Bill Bryson in A Short History of Nearly Everything. In it, he notes that there are 1M seconds in 11 days but 1B seconds takes 32 years.
- manquer 1y agoAn regular user would associate 4k is premium / expensive and difficult to use without better phones/network/plans/signal strength etc so the idea would be to be signal it is 1M times with a somewhat challenging thing for them. Non-tech savy users know how live streams crash with sports like with Netflix recently during boxing etc or on Twitter last year and usually those come with some n Million users in kind of headlines or the like, so they have some reference to that scale. As analogies go, there are worse examples. BleepingComputer is hardly the New Yorker or Atlantic, best we can hope for these days is a human is writing the article I suppose.
- fishgoesblub 1y agoI've always disliked the "it's like X amount of [resolution] video!!" Are we talking a UHD 4K Bluray? or 4K Netflix? or 4K YouTube? Bitrate is all that matters.
- sunaookami 1y agoWell I found it helpful for putting it into perspective.
- haunter 1y agoThis is what I don't get >The Aisuru DDoS botnet operates as a DDoS-for-hire service with restricted clientele; operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national security properties. Most observed Aisuru attacks to date appear to be related to online gaming. https://www.netscout.com/blog/asert/asert-threat-summary-aisuru-and-related-turbomirai-botnet-ddos https://www.netscout.com/blog/asert/asert-threat-summary-ais... So why? Like why would someone pay to take a game down? I see this all over reddit with different games but I just don't get the point. What's the benefit of taking down an online game for a couple of hours.
- begueradj 1y agoYou are questioning the human nature.
- denkmoon 1y agoMad salt. Imagine a fully grown man having a toddler tantrum. "If I can't play/win/get my way, nobody can" type mentality. It's also a method of coercion. Give me mod status or I'll DDOS your server and destroy your community. The other half comes from sever operators ddosing their competition. There is a lot of money to be made from paid cosmetics, ranks, moderator (demi-tyrant) status, etc on custom servers.
- sabatonfan 1y agoWhat you are saying fits perfectly well in minecraft communities. Are you mentioning the minecraft community by your message or any other gaming communities too
- rasz 1y agohttps://en.wikipedia.org/wiki/Mirai_(malware) https://en.wikipedia.org/wiki/Mirai_(malware) came from Minecraft community.
- alickz 1y ago>There is a lot of money to be made from paid cosmetics, ranks, moderator (demi-tyrant) status, etc on custom servers. Anyone have any idea how much a 15 Tbps DDoS attack would cost? Thousands of dollars? Tens of thousands?
- deleted 1y ago[deleted]
- YetAnotherNick 1y ago> This attack lasted only 40 seconds What's the point of this? Are they continuously running DDoS somewhere and 40 second is what the buyer paid for?
- orbital-decay 1y agoIt's basically an ad.
- ACCount37 1y ago"Look at how big of a botnet we have! Imagine all of that, but on the target YOU want to go down!" It's how you do marketing, basically.
- aydyn 1y ago> Aisuru is a Turbo Mirai-class IoT botnet IoT botnet. Just read that again, we're literally inventing problems where none needs to exist. IoT adds basically null or negative value, except to nerds who like to think they're smarter than other people by consuming the latest e-slop. Its all so tiresome.
- nunez 1y agoMy Hue lights and vacuums would like a word!
- ACCount37 1y agoMost "IoT botnet" devices are Wi-Fi routers and IP cameras. Which are the two classes of IoT devices that provide undisputed value. Maybe, just maybe, people aren't as stupid as you think they are?
- aydyn 1y agoRouters are generally not considered IoT devices. So your second sentence is kind of ironic.
- Uptrenda 1y agoMan, if you had that many nodes can you guys imagine how much cool tech you could build with that? Like you could literally rival Tor with one command. Or build a decentralized archive system. Yet, the only thing these nodes will end up doing is being used to prop up some losers ego. Literally what a waste. If you're going to commit crime at least do something cool.
- GaryNumanVevo 1y agoMost of the compromised devices are routers or IoT devices, functionally no compute power to do anything interesting except spam IPs with requests.
- mgaunard 1y agoYou could easily get better performance with a pair of well-optimized high-density cabinets, much more reliable and not even that expensive to operate legitimately.
- mgaunard 1y ago500k isn't even that many. Can probably rent that many IPs for a few grand.
- helsinkiandrew 1y ago> by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries, Presumably it’s possible to log the residential IP of the source of these packets. Why isn’t there any industry group pushing for the ISPs to a) send the owners an email telling them or b) blocking off all traffic for a period to get them to do something - or is the economic cost higher than caused by the DDoS attacks?
- matt-p 1y agoThe economic costs of that fall on the (residential) ISPs and they aren't really incurring very much cost in additional bandwidth from the outgoing attacks. In most cases it will be 0. It's not 'good', as it could affect quality to a certain extent for other subscribers and it's theoretically possible it could result in a slightly higher transit bill, but ultimately it's just not really a problem for them. Setting up the infrastructure to email customers and tell them they've got an infected device is just going to cause the subscriber to: A) Call customer support and tie up an agent who can't really tell them much - you're also going to have to train all your CS agents on these letters and what they mean. B) Complain on faceybook/Churn off your network. or C) They'll ignore it About one in a million will fix the issue themselves.
- BeFlatXIII 1y agoThis is why we need an external rogue actor to send those notification emails without ISP consent.
- mrweasel 1y agoThat industry group would need to include the big cloud providers, and they also doesn't want to shut of abusive traffic.
- ramon156 1y agoThis already happens in the Netherlands, your router will be put in quarantine mode and you have to prove that the "virus" is gone This happened to me, at the time I thought it was strange but seeing this event happen it makes a lot more sense now
- sammy2255 1y agoCloudflare eats that up for breakfast
- isodude 1y agoThis did not age well!
- amelius 1y agoAre these IP addresses available somewhere so I can check if I'm part of it?
- DownGoat 1y agoYou can assume that you are part of it or another similar botnet if you have any IoT device exposed to the internet. You can use something like Shodan to see how your network looks like from the outside
- elAhmo 1y agoWhat can be the result of this? Seems useless, you might make a dent but why?
- ulrikrasmussen 1y agoIronically I can't read this article due to the ongoing Cloudflare explosion.
- johnisgood 1y agoYup, many links I have tried to access without success. Well, sucks to have such a centralized Internet.
- jadbox 1y agoI am surprised no one has mentioned that today is Microsoft's conference keynote.
- deleted 1y ago[deleted]
- drob518 1y agoImpressive. Just reacting to the headline since the article is inaccessible.
- bentt 1y agoIt took over 10 seconds to add a To-Do item to my Microsoft To-Do app. Apparently an item cannot be added until the server responds?
- Andrew-Tate 1y ago[flagged]
- musicale 1y ago> "These sudden UDP bursts had minimal source spoofing and used random source ports, which helped simplify traceback and facilitated provider enforcement." That seems fairly blockable.