Skip to content
HACKTECH
Mobile & IoTReported Published 5 sources

Authorities disrupt Aisuru, Kimwolf, JackSkid and Mossad IoT DDoS botnets

The US Justice Department, working with authorities in Germany and Canada, disrupted command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets in March 2026. According to the DOJ, as reported by BleepingComputer and KrebsOnSecurity, the four botnets collectively infected more than three million IoT devices, including web cameras, digital video recorders and Wi-Fi routers, and their operators sold access to other cybercriminals to launch DDoS attacks. Cloudflare's 2025 Q4 report had described a record 31.4 Tbps attack and a quarter it said was characterised by an 'unprecedented bombardment' from the Aisuru-Kimwolf botnet; its Q3 2026 report recorded a sharp fall in attacks above 1 Tbps.

  • DDoS
  • IoT botnets
  • Aisuru
  • Kimwolf
  • law enforcement
  • Android TV

What the sources report

  • According to DOJ court documents cited by BleepingComputer, Aisuru issued more than 200,000 DDoS attack commands, JackSkid more than 90,000, KimWolf more than 25,000 and Mossad more than 1,000.
  • KrebsOnSecurity reported that the Defense Criminal Investigative Service executed seizure warrants against multiple US-registered domains, virtual servers and other infrastructure involved in DDoS attacks on Department of Defense IP addresses, and that the FBI's Anchorage field office assisted the investigation.
  • Cloudflare's 2025 Q4 report recorded a 31.4 Tbps attack that lasted 35 seconds and a campaign beginning 19 December 2025 that peaked at 205 million requests per second; it described Aisuru-Kimwolf as primarily infected Android TVs, with an estimated 1 to 4 million infected hosts.
  • KrebsOnSecurity reported that Kimwolf, an Aisuru variant seeded in October 2025, could infect devices on users' internal networks, and that Synthient publicly disclosed the vulnerability it used to spread on 2 January 2026.
  • Cloudflare counted 251 network-layer attacks above 1 Tbps in Q3 2026, down from 805 in Q2, describing the drop as possibly a reflection of the law enforcement action, while new IoT botnet variants such as Dysphoria and Evooo1Bot emerged.
  • In May 2026 BleepingComputer reported that US and Canadian authorities had arrested and charged a suspected KimWolf administrator, and that separately unsealed seizure warrants targeted 45 DDoS-for-hire platforms.

What it means for your organisation

The botnets were built from internet-connected consumer devices such as web cameras, video recorders, routers and Android TV boxes, and Kimwolf showed that devices behind a home or office router are not out of reach. Cloudflare reports that the record 31.4 Tbps attack lasted 35 seconds and that most attacks end before a human analyst could see an alert, so mitigation has to be automatic and arranged with upstream providers in advance. Attacks above 1 Tbps fell after the takedown, but Cloudflare reports new variants emerging and KrebsOnSecurity describes copycat botnets competing for the same pool of vulnerable devices.

What we check

  • Enumerate internet-exposed IoT devices (cameras, DVRs, routers) on your address ranges and test them for default credentials, exposed management services and outdated firmware.
  • Test whether unmanaged Android TV boxes, or devices running residential-proxy software on guest or office networks, can reach internal hosts, and verify segmentation between IoT and corporate VLANs.
  • Review DDoS runbooks and contracts: always-on scrubbing, upstream escalation contacts, and protection of DNS and origin IP addresses that could be attacked directly.
  • Check egress filtering and flow monitoring for signs that your own devices are taking part in outbound floods.

Sources

Services that cover these checks

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Threat modelling

    Facilitated workshops that map how a system or feature could be attacked before it is built or shipped. We draw the data flows with your engineers, walk them with STRIDE, rank the threats by likelihood and impact, and turn the result into backlog items and test cases your team owns.

    Duration: 2 to 5 days per system, remote or on site

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works