Security expert Brian Krebs targeted by 6.3 terabit per second DDoS attack

Security researcher Brian Krebs' website was recently hit by one of the largest distributed denial-of-service (DDoS) attacks ever recorded, with traffic reaching 6.3 terabits per second. The attack, however, lasted only about 45 seconds.

Krebs reported that the attack's speed was ten times greater than a similar incident in 2016 that took his blog offline for four days. Following that earlier attack, Akamai, which had been providing protection, ceased its services for the site. Since then, Krebs' website has been protected by Google's "Project Shield," a service for news sites, and the recent attack marked the largest encountered by this service.

According to information gathered by Krebs, the attack was likely orchestrated by a botnet known as Aisuru, which is composed of hijacked devices and has been active since August 2024. Services from this botnet are reportedly advertised on Telegram, with costs reaching up to $600 per week for taking down websites. Google estimates that very few websites can withstand the volume of traffic generated by such a botnet.

Krebs speculates that both the assault on his site and a previous, even more powerful attack on Cloudflare in April were intended as demonstrations for potential clients. Due to their short duration, these attacks caused no noticeable disruption but effectively showcased their capabilities. The botnet's originator is believed to be an individual in Brazil who has reportedly stepped down from managing the botnet.

Krebs suggested that making the source code of successful botnets, like the Mirai botnet and potentially Aisuru, publicly available could increase competition and thereby reduce the potency of individual attacks.