Global Crackdown on DDoS Mercenaries: Botnet-for-Hire Services Targeted After Record 29.7 Tbps Attack

The Rise and Fall of the DDoS Mercenaries

In a significant blow to the cybercrime-as-a-service ecosystem, a multinational law enforcement operation has successfully disrupted several major DDoS-for-hire platforms. This crackdown, spearheaded by the Brazilian Federal Police (PF) under 'Operation Power OFF' and supported by the U.S. Federal Bureau of Investigation (FBI), targeted the infrastructure and individuals behind services that weaponized distributed denial-of-service (DDoS) attacks for profit. The operation's urgency was underscored by its connection to a recently documented, record-shattering DDoS attack measuring 29.7 terabits per second (Tbps).

The AISURU Botnet: A Record-Breaking Threat

The unprecedented 29.7 Tbps attack, one of the largest ever recorded, has been formally linked to a botnet known as AISURU. Security researchers analyzing the attack patterns estimate that AISURU could control a network of up to 4 million compromised hosts globally. These infected devices, ranging from vulnerable IoT gadgets to servers, were harnessed to generate a flood of malicious traffic capable of overwhelming even the most robust online infrastructure. While the ultimate target of this specific mega-attack remains undisclosed, its sheer scale demonstrates the catastrophic potential of modern, professionally managed botnets.

Operation Power OFF: Taking Down the Marketplace

The Brazilian Federal Police's investigation, which began in mid-2024, uncovered a sophisticated criminal scheme. The targeted platforms operated on a subscription model, openly advertising their services on the open web and in closed forums. For prices as low as $10, customers could purchase DDoS attacks capable of knocking websites offline for hours. Investigators found that these 'cyber mercenaries' had been hired to attack a wide array of Brazilian government digital assets. High-profile victims included the official websites of the Brazilian Army, the Ministry of Management and Innovation, and the National Institute of Colonization and Agrarian Reform (INCRA). The attacks aimed to cause widespread disruption, hinder public access to services, and undermine institutional credibility.

A Global Trend of Commoditized Attacks

This law enforcement action coincides with alarming industry reports about the escalating DDoS threat landscape. Cybersecurity firm Cloudflare has recently warned that the volume and sophistication of DDoS attacks in 2025 have surged by approximately 70% compared to the previous year. Attacks are not only growing in size (measured in bits per second) but also in complexity, with attackers increasingly using multi-vector approaches that combine volumetric floods with application-layer attacks to bypass traditional defenses.

The dismantling of these for-hire services highlights a critical shift: DDoS attacks have transitioned from tools of hacktivists to a commoditized service within the cybercriminal economy. This democratization of attack power allows individuals with minimal technical skill to launch devastating attacks, significantly lowering the barrier to entry for digital sabotage.

Implications for Network Security Professionals

The convergence of these events—the record-breaking attack and the subsequent takedown—delivers several key takeaways for the cybersecurity community:

1. The Botnet Threat is Scaling Exponentially: The potential of a 4-million-node botnet underscores the critical importance of securing connected devices and implementing robust threat intelligence to identify and mitigate botnet recruitment activities.
2. The 'Mercenary' Model is in the Crosshairs: Law enforcement is increasingly focusing on the service providers within the cybercrime chain, not just the end-users. This strategy aims to dismantle the economic model that makes such attacks easily accessible.
3. Government Assets are Prime Targets: The specific targeting of state entities in Brazil reveals a trend where threat actors seek maximum disruptive impact and psychological effect, moving beyond financial targets.
4. Defense Must Evolve: The 70% increase in attack sophistication reported by Cloudflare is a clear mandate for organizations to move beyond basic rate-limiting. Defense strategies must now incorporate advanced DDoS mitigation services, scalable cloud-based protection, and proactive stress-testing of infrastructure resilience.

The Path Forward: Resilience and Cooperation

While Operation Power OFF represents a tactical victory, the strategic battle continues. The takedown of one set of platforms creates a temporary vacuum that other threat actors will seek to fill. The enduring solution lies in a multi-pronged approach: continued international police cooperation, stricter legal frameworks against the creation and sale of attack tools, and a relentless focus by organizations on building inherently resilient networks capable of weathering the ever-larger storms of malicious traffic.

The message from this coordinated crackdown is unequivocal. The era of DDoS attacks as a cheap and easily accessible nuisance is being challenged. However, the cybersecurity community must remain vigilant, as the underlying technologies and criminal incentives that gave rise to these 'DDoS mercenaries' are still very much alive.