Aisuru

AISURU is an Internet-of-Things botnet associated with large-scale distributed denial-of-service operations and a broader ecosystem of related malware and infrastructure. It has been cited alongside Mirai-derived and Keksec-linked botnet activity, and later law-enforcement actions grouped it with KimWolf, JackSkid, and Mossad as part of a cluster of high-impact IoT botnets. Reporting has also described KimWolf as a variant of AISURU, indicating code or operational lineage within the same botnet family.

The malware compromises internet-connected devices and enrolls them into a botnet used for volumetric DDoS attacks. Public reporting attributes record-setting attacks to AISURU, including multi-terabit events, and describes the botnet as having infected millions of devices at peak scale. Operational behavior associated with the AISURU ecosystem includes scanning for exposed services, exploiting weak or default credentials, and targeting exposed Android Debug Bridge on Android-based devices. Android and embedded IoT systems such as routers, cameras, DVRs, streaming devices, digital photo frames, and similar consumer or small-office hardware have been associated with this activity.

AISURU has also been linked to cybercrime-as-a-service operations in which botnet capacity was rented to other actors for DDoS attacks. Beyond denial-of-service activity, reporting has connected the broader AISURU-linked ecosystem to proxy enablement and abuse of compromised residential connectivity, although the core, consistently supported characterization of AISURU is as an IoT DDoS botnet. International disruption efforts in 2026 targeted command-and-control infrastructure associated with AISURU and related botnets, reflecting its significance as a major operational threat in the IoT botnet landscape.