What Is the AISURU Botnet? The Terabit DDoS Threat Explained

AISURU is among the most active and powerful DDoS botnets seen across 2025–2026, capable of terabit-scale attacks. If you run a game server, it's worth understanding what you're up against, how AISURU compares to older botnets like Mirai, and what actually stops it.

What is AISURU?

AISURU (also tracked as Airashi) is a botnet — a network of internet-connected devices that have been infected with malware and can be controlled remotely to launch coordinated attacks. Built on a Mirai-style codebase, it spreads across compromised IoT devices and turns them into a distributed weapon.

What sets it apart is raw scale. AISURU has been associated with attacks reaching hundreds of gigabits to multiple terabits per second — enough to saturate an unprotected server's connection in seconds.

How does it spread?

Like Mirai before it, AISURU scans the internet for poorly-secured devices — home routers, IP cameras, DVRs and NAS boxes still running default passwords or unpatched firmware. Each infected device becomes a small "bot". Tens of thousands of them together form a weapon that can be rented and aimed at any IP address.

This is the dangerous part: an attack no longer needs a skilled adversary. Anyone with a few dollars can rent botnet time and point it at a server out of rivalry, revenge or extortion.

Why gaming is the #1 target

Game servers, voice servers and the panels around them are prime targets. The motives are simple and common:

• Rivalry — knocking a competing community offline to steal its players.
• Grudges — a banned player or former staff member taking revenge.
• Timing — attacks land on wipe day, match day or an event, at the worst possible moment.
• Extortion — "pay us or stay offline".

How big are AISURU attacks, really?

Network operators and security researchers tracking AISURU through 2025 and into 2026 have logged sustained floods well past 1 Tbps, with peaks in the multiple-terabit range against gaming and hosting targets. For scale: a typical dedicated server's uplink is measured in single-digit gigabits, so one AISURU burst can be a thousand times larger than the pipe it is aimed at. That gap is exactly why "just add more bandwidth" was never a real defence.

AISURU vs Mirai and other IoT botnets

AISURU did not appear from nowhere. It descends from the original Mirai botnet of 2016, which first proved that thousands of hijacked cameras and routers could take down major internet services. Dozens of Mirai-derived botnets have followed, each bigger than the last, and AISURU stands out both for its scale and for how quickly its power gets resold through booter services. For more context on the record-setters, see our list of the biggest DDoS attacks in history.

Could your own device be part of it?

AISURU spreads by finding devices with default admin passwords, exposed management ports or unpatched firmware. Most owners have no idea their router or camera is infected, because it keeps working normally while quietly joining attacks in the background. A few habits cut the risk sharply:

• Change every default password on routers, cameras, DVRs and smart-home gear.
• Keep firmware updated — manufacturers patch the exact bugs botnets scan for.
• Disable remote or UPnP admin access you don't actually use.
• Reboot and re-check devices periodically; some malware does not survive a reboot.

AISURU and the booter economy

What makes AISURU dangerous to ordinary communities, not just large companies, is that its power is for rent. Booter and stresser services package botnets like AISURU into a few-click web interface — pick a target, pick a duration, pay, and the attack fires. That's why gaming rivalries and grudges now escalate to terabit-scale attacks that once required serious resources. See the wider pattern in our breakdown of DDoS trends in 2025–2026.

Frequently asked questions

Can antivirus stop AISURU? Not directly — AISURU infects routers, cameras and IoT boxes that don't run antivirus at all. As a target, the danger to you is receiving its traffic, not being infected by it.

Will changing my server's IP help? Only briefly. If a botnet already has your old IP queued, it keeps firing at it, and a determined attacker usually re-discovers a new IP fast. A new IP is a stopgap, not a fix — see how to protect your game server from DDoS for what actually works.

How do you actually stop it?

You can't out-bandwidth a terabit botnet from a single box — the traffic has to be absorbed and filtered before it reaches your machine. That means always-on mitigation with multi-Tbps capacity sitting in front of your server, dropping malicious packets at the network edge while clean traffic flows through.

If your provider can't absorb and filter that volume before it reaches your machine, your service goes down. Mitigation has to be measured in terabits.

That's exactly why ESAGAMES built its own protection stack — a multi-Tbps Frankfurt filtering network plus custom in-house XDP mitigation — instead of relying on a single upstream. Every service we host is filtered by default.