TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Krebs on Security

Feds Disrupt IoT Botnets Behind Huge DDoS Attacks

BrianKrebs · 2026-03-20 · Read original ↗

ATT&CK techniques detected

6 predictions
T1498Network Denial of Service
79%
“feds disrupt iot botnets behind huge ddos attacks the u. s. justice department joined authorities in canada and germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million internet of things ( iot ) devices, such…”
T1498.001Direct Network Flood
76%
“feds disrupt iot botnets behind huge ddos attacks the u. s. justice department joined authorities in canada and germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million internet of things ( iot ) devices, such…”
T1498Network Denial of Service
72%
“victims. some victims reported tens of thousands of dollars in losses and remediation expenses. the oldest of the botnets — aisuru — issued more than 200, 000 attacks commands, while jackskid hurled at least 90, 000 attacks. kimwolf issued more than 25, 000 attack commands, the g…”
T1498.001Direct Network Flood
68%
“victims. some victims reported tens of thousands of dollars in losses and remediation expenses. the oldest of the botnets — aisuru — issued more than 200, 000 attacks commands, while jackskid hurled at least 90, 000 attacks. kimwolf issued more than 25, 000 attack commands, the g…”
T1498.001Direct Network Flood
63%
“- breaking ddos attacks as it rapidly infected new iot devices. in october 2025, aisuru was used to seed kimwolf, an aisuru variant which introduced a novel spreading mechanism that allowed the botnet to infect devices hidden behind the protection of the user ’ s internal network…”
T1584.005Botnet
40%
“- breaking ddos attacks as it rapidly infected new iot devices. in october 2025, aisuru was used to seed kimwolf, an aisuru variant which introduced a novel spreading mechanism that allowed the botnet to infect devices hidden behind the protection of the user ’ s internal network…”

Summary

The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million hacked Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets -- named Aisuru, Kimwolf, JackSkid and Mossad -- are responsible for a series of recent record-smashing distributed denial-of-service (DDoS) attacks capable of knocking nearly any target offline.