The IT Nerd

Arelion today announced the findings of its latest DDoS threat landscape report, providing insights on global Distributed-Denial-of-Service (DDoS) trends using traffic data from its #1 ranked Internet backbone, AS1299. The report shows that a single botnet, Aisuru, now drives approximately 33 percent of global DDoS attack traffic on Arelion’s network. Additionally, DDoS attacks have become hypervolumetric, with record-breaking attacks hitting 6.1 terabits per second (Tbps). 

Arelion’s report highlights that AI has greatly lowered the barrier to launching complex DDoS attacks, with automated botnets able to overwhelm critical infrastructure within seconds.The Aisuru botnet emerged as the most disruptive DDoS threat of 2025, harnessing more than 500,000 compromised Internet of Things (IoT) devices and Android-based systems to launch record-breaking attacks. Aisuru reached 31.4 Tbps in December 2025 at its peak, making it one of the largest DDoS attacks ever recorded. 

Aisuru primarily targeted major gaming and cloud providers, with attacks often exceeding 1 Tbps across Arelion’s backbone. By early 2026, KimWolf (Aisuru’s variant) had also infected over 2 million Android TV and streaming devices. Attacks of previous years favored smaller, faster packets designed to evade detection, but Aisuru changed that dynamic, combining brute-force volume with multi-vector complexity.

Arelion’s report shows that the hypervolumetric DDoS attacks of 2025-2026 mark a new era of cyber threats, mostly driven by automated attacks enabled by AI. These attack volumes often exceed 1 Tbps, totaling billions of packets per second. 

Various factors are driving this shift, with IoT proliferation, distributed cloud infrastructure and 5G networks enabling botnets of unprecedented scale to be dispersed across millions of endpoints. The shift of the threat surface from data center servers to home devices has enabled botnets to drive large-scale DDoSattacks from distributed home networks.

Average attack volumes rose significantly, with gigabits per second (Gbps) rising by 22 percent to 6,120 Gbps, million packets per second (Mpps) increasing by 60 percent to 999 Mpps and peak attack traffic in Gbps rising by 290 percent, underscoring the shift to hyperscale-level disruption. 

Meanwhile, average attack duration dropped by 20 percent to 8.9 minutes, indicating a trend toward shorter, more frequent “carpet bombing” campaigns. The result is a broader and heavier distribution across all size categories, placing greater pressure on mitigation strategies designed for lower‑intensity threats.

The report also establishes that nation-state actors remain key players in the threat landscape. In 2025, geopolitically motivated attacks persisted across NATO-aligned European nations, most notably Spain and Bulgaria. 

The Middle East emerged as a DDoS frontline, with state-aligned groups intensifying DDoS campaigns against critical infrastructure. As state actors have restricted internet access internally while clandestinely backing external cyberattacks, weaponized DDoS attacks have directly and indirectly supported military action on the ground. 

Despite hundreds of daily attacks from the Aisuru botnet, Arelion’s high-capacity backbone absorbed the malicious traffic with minimal customer disruption, highlighting the importance of network-based mitigation and capacity at scale. In one example, a major online gaming platform sustained multi-vector attacks peaking at several Tbps. 

Arelion’s always-on, network-level mitigation filtered the malicious traffic and preserved legitimate sessions, helping the platform minimize disruption despite the sheer size of the attack. By stopping malicious traffic within its global backbone before it reaches customer networks, Arelion helps businesses maintain continuity, protect critical applications and strengthen their DDoS defenses as threats continue to evolve.

Read the full report here for more information.

 Arelion today announced the release of its SecureConnect Dedicated Internet Access (DIA) and SecureConnect Transit solutions, providing automated DDoS mitigation to enterprise and wholesale customers. These products are bundled into Arelion’ global connectivity services, including IP Transit and DIA, making them simple add-ons for any IP or DIA customer. SecureConnect strengthens frontline security as AI-enabled network attacks increasingly target automotive, manufacturing, financial services and other critical industries, and the suppliers to those industries.

SecureConnect automatically detects common DDoS attack types, especially volumetric threats, then uses the Flowspec protocol to stop attacks at the network edge. This functionality provides Arelion’s customers with more granular DDoS mitigation than brute-force defenses, such as blackholing, without adding implementation complexity. SecureConnect can also improve companies’ chances of meeting International Organization for Standardization (ISO) certification requirements without major investment. With edge-based Flowspec defenses in SecureConnect and global scrubbing centers across Europe, the Americas and Asia strengthening its full DDoS mitigation service, Arelion protects customers against today’s increasingly weaponized internet, giving them greater confidence in their global connectivity evolution.

SecureConnect addresses rising risks across global networks, helping enterprises block AI-enabled threats that attempt to overwhelm defenses with smaller, higher-frequency attacks. Arelion’s network data shows that the average volumetric attack size increased by 97 percent from 2023 to 2024, reflecting attackers’ ability to leverage greater available capacities year-on-year. Another report shows that over 50 percent of automotive and manufacturing leaders see cybersecurity as their top network challenge, recognizing that AI-enabled threats facilitate an endless cycle of attack and defense.

For further information, visit the SecureConnect product page.

Arelion today announced it has expanded its partnership with NETSCOUT, a leading provider of performance management, cybersecurity and DDoS attack protection solutions, to strengthen the Internet carrier’s DDoS attack mitigation capabilities. This expanded partnership enables Arelion to support the network security requirements of global enterprises amid rising attacks on critical infrastructure. By enhancing its capabilities with NETSCOUT, Arelion improves network security across its #1 ranked global Internet backbone, empowering enterprise customers with resilient, high-performance connectivity services.

The expanded partnership significantly increases the density of Arelion’s network monitoring across its global Internet backbone, providing better protection for enterprises’ high-bandwidth applications. This enhancement empowers Arelion with more granular visibility of traffic patterns, enabling faster detection of anomalies and speedier threat responses. By augmenting its DDoS attack mitigation capabilities with Adaptive DDoS protection, Arelion also improves its defenses against newer DDoS attack vectors and techniques, including carpet bombing.

With this expanded partnership, Arelion provides its global customers with secure access to Arelion’s #1 ranked global Internet backbone. Arelion’s enhanced DDoS attack mitigation services are currently available for service providers, content providers and enterprises.