What Is the AISURU Botnet? The Terabit DDoS Threat Explained

AISURU is among the most active and powerful DDoS botnets seen across 2025–2026, capable of terabit-scale attacks. If you run a game server, it's worth understanding what you're up against — and what actually stops it.

What is AISURU?

AISURU (also tracked as Airashi) is a botnet — a network of internet-connected devices that have been infected with malware and can be controlled remotely to launch coordinated attacks. Built on a Mirai-style codebase, it spreads across compromised IoT devices and turns them into a distributed weapon.

What sets it apart is raw scale. AISURU has been associated with attacks reaching hundreds of gigabits to multiple terabits per second — enough to saturate an unprotected server's connection in seconds.

How does it spread?

Like Mirai before it, AISURU scans the internet for poorly-secured devices — home routers, IP cameras, DVRs and NAS boxes still running default passwords or unpatched firmware. Each infected device becomes a small "bot". Tens of thousands of them together form a weapon that can be rented and aimed at any IP address.

This is the dangerous part: an attack no longer needs a skilled adversary. Anyone with a few dollars can rent botnet time and point it at a server out of rivalry, revenge or extortion.

Why gaming is the #1 target

Game servers, voice servers and the panels around them are prime targets. The motives are simple and common:

• Rivalry — knocking a competing community offline to steal its players.
• Grudges — a banned player or former staff member taking revenge.
• Timing — attacks land on wipe day, match day or an event, at the worst possible moment.
• Extortion — "pay us or stay offline".

How do you actually stop it?

You can't out-bandwidth a terabit botnet from a single box — the traffic has to be absorbed and filtered before it reaches your machine. That means always-on mitigation with multi-Tbps capacity sitting in front of your server, dropping malicious packets at the network edge while clean traffic flows through.

If your provider can't absorb and filter that volume before it reaches your machine, your service goes down. Mitigation has to be measured in terabits.

That's exactly why ESAGAMES built its own protection stack — a multi-Tbps Frankfurt filtering network plus custom in-house XDP mitigation — instead of relying on a single upstream. Every service we host is filtered by default.