Web performance and security company Cloudflare reported on Tuesday that its systems blocked another record-breaking distributed denial-of-service (DDoS) attack.
The latest record-breaking attack peaked at 22.2 terabits per second (Tbps) and 10.6 billion packets per second (Bpps), and lasted only 40 seconds.
The company said this hyper-volumetric DDoS attack, which was double in size compared to the previous record, was autonomously blocked by its systems.
Cloudflare told SecurityWeek that the attack was aimed at a single IP address of an unnamed European network infrastructure company.
Cloudflare has yet to determine who was behind the attack, but believes it may have been powered by the Aisuru botnet, which was also linked earlier this year to a massive 6.3 Tbps attack on the website of cybersecurity blogger Brian Krebs.
Aisuru has been around for more than a year. The botnet is powered by hacked IoT devices such as routers and DVRs that have been compromised through the exploitation of known and zero-day vulnerabilities.
According to Cloudflare, the 22 Tbps attack was traced to over 404,000 unique source IPs across over 14 ASNs worldwide. “Based on internal analysis using a proprietary system, the source IPs were not spoofed,” the company explained.
The security firm described it as a UDP carpet bomb attack targeting an average of 31,000 destination ports per second, with a peak of 47k ports, all of a single IP address.
Cloudflare revealed in July that the number of DDoS attacks it blocked in the first half of 2025 had already exceeded all the attacks mitigated in 2024.
Related: ShadowV2 DDoS Service Lets Customers Self-Manage Attacks
Related: ‘MadeYouReset’ HTTP2 Vulnerability Enables Massive DDoS Attacks
Related: Record-Breaking 7.3 Tbps DDoS Attack Targets Hosting Provider
