LmCast :: Stay tuned in

International joint action disrupts world’s largest DDoS botnets

Recorded: March 20, 2026, 9 a.m.

Original Summarized

International joint action disrupts world’s largest DDoS botnets

News

Featured
Latest

ConnectWise patches new flaw allowing ScreenConnect hijacking

New DarkSword iOS exploit used in infostealer attack on iPhones

Apple pushes first Background Security Improvements update to fix WebKit flaw

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

International joint action disrupts world’s largest DDoS botnets

Microsoft: March Windows updates break Teams, OneDrive sign-ins

Ex-data analyst stole company data in $2.5M extortion scheme

Navia discloses data breach impacting 2.7 million people

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityInternational joint action disrupts world’s largest DDoS botnets

International joint action disrupts world’s largest DDoS botnets

By Sergiu Gatlan

March 20, 2026
04:05 AM
0

Authorities from the United States, Germany, and Canada have taken down Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things (IoT) devices.
The joint law enforcement action also targeted virtual servers, internet domains, and other infrastructure used by the four botnets to launch hundreds of thousands of massive Distributed Denial of Service (DDoS) attacks against victims worldwide in recent months, including IP addresses owned by the Department of Defense Information Network (DoDIN).
For instance, in December, the Aisuru botnet set a new record with a DDoS attack that peaked at 31.4 Tbps and 200 million requests per second as part of a broader campaign targeting multiple companies, most of which were in the telecommunications sector.
Aisuru was also behind a previous DDoS record of 29.7 Tbps, while an incident originating from 500,000 IP addresses(which Microsoft attributed to the same botnet) peaked at 15.72 Tbps in November.
"This operation, in coordination with other international law enforcement actions, is intended to disrupt communications associated with the Aisuru, KimWolf, JackSkid, and Mossad botnets, preventing further infection to victim devices and limiting or eliminating the ability of the botnets to launch future attack," the Justice Department said.
"Court documents allege that the Aisuru botnet issued more than 200,000 DDoS attack commands, the KimWolf botnet issued more than 25,000 DDoS attack commands, the JackSkid botnet launched more than 90,000 DDoS attack commands and the Mossad botnet launched more than 1,000 DDoS attack commands."
According to the U.S. Justice Department, these botnets have collectively infected and ensnared over three million IoT devices, including web cameras, digital video recorders, and WiFi routers, many of them located in the United States.
The botnet operators sold access to other cybercriminals under a cybercrime-as-a-service model, enabling them to launch DDoS attacks that resulted in tens of thousands of dollars in losses and remediation costs.
"These attacks can cripple core internet infrastructure, cause significant service degradation for ISPs and their downstream customers, and even overwhelm high-capacity cloud-based mitigation services," said cybersecurity and cloud computing company Akamai, which was one of the private sector firms involved in the joint action.
"Cybercriminals used these botnets to launch hundreds of thousands of attacks, in some cases demanding extortion payments from victims."

Red Report 2026: Why Ransomware Encryption Dropped 38%
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.
Download The Report

Related Articles:
Aisuru botnet sets new record with 31.4 Tbps DDoS attackSpain arrests suspected hacktivists for DDoSing govt sitesUS disrupts SocksEscort proxy network powered by Linux malwareNew KadNap botnet hijacks ASUS routers to fuel cybercrime proxy networkNew Linux botnet SSHStalker uses old-school IRC for C2 comms

Aisuru
Botnet
DDoS
Distributed Denial-of-Service
IoT
JackSkid
Kimwolf
Mossad

Sergiu Gatlan
Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips.

Previous Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

Popular Stories

CISA urges US orgs to secure Microsoft Intune systems after Stryker breach

Max severity Ubiquiti UniFi flaw may allow account takeover

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

Sponsor Posts

Are refund fraud methods targeting your brand? You can monitor the underground for these threats.

Overdue a password health-check? Audit your Active Directory for free

Cut VMware migration time by 60% with Acronis—move workloads faster, with less downtime.

Uncover shadow AI apps, users, and risky data sharing. Get started in 5 min.

Secure your AI agents without sacrificing speed.

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

This report details a significant international law enforcement operation targeting several large Distributed Denial of Service (DDoS) botnets – Aisuru, KimWolf, JackSkid, and Mossad – orchestrated between the United States, Germany, and Canada. The core objective of the coordinated action was to disrupt the Command and Control (C2) infrastructure supporting these botnets, effectively preventing further IoT device infections and future DDoS attacks. The operation’s success stemmed from identifying and neutralizing virtual servers, internet domains, and other associated infrastructure utilized by the botnets.

Specifically, the Justice Department revealed substantial data regarding the botnets' activities, including the issuance of over 200,000 DDoS attack commands by the Aisuru botnet, 25,000 by the KimWolf botnet, 90,000 by the JackSkid botnet, and over 1,000 by the Mossad botnet. These botnets had amassed a staggering infection footprint, compromising over three million IoT devices – encompassing web cameras, digital video recorders, and WiFi routers – predominantly located within the United States. The botnets operated under a cybercrime-as-a-service model, selling their capabilities to other cybercriminals, facilitating attacks that resulted in considerable financial losses and remediation costs. Instances of extortion demands, leveraging the disruptive potential of these attacks, were also identified.

The attacks, as exemplified by a peak of 31.4 Tbps achieved by the Aisuru botnet in a recent December incident, demonstrated their capacity to overwhelm network infrastructure, severely impacting telecommunications companies and even cloud-based mitigation services. Akamai, a cybersecurity and cloud computing firm, highlighted the critical risk posed by these attacks, emphasizing the potential to cripple core internet services and demanding significant remediation costs. The impact was measured in terms of massive request per second throughput as well as the sheer volume of attacks.

Investigations revealed these botnets utilized older communication methods, such as outdated IRC channels, to maintain command and control, suggesting a reliance on established technologies rather than sophisticated, modern C2 frameworks. The involvement of entities like the Department of Defense Information Network (DoDIN) as targets underscores the potential for these threats to directly impact critical national infrastructure. This coordinated response represents a significant deterrent against the continuation of these malicious activities and highlights the importance of international cooperation in combating sophisticated cyber threats.