Microsoft Blocks Largest-Ever Cloud DDoS Attack Aimed At Australian Website: Here’s What Happened

Microsoft has disclosed that it stopped what it calls the largest cloud-based Distributed Denial-of-Service (DDoS) attack recorded to date. The attack targeted a single website in Australia and was picked up by Microsoft’s Azure DDoS Protection system. The company says the incident happened on October 24, 2025, and that Azure stepped in automatically before the attack could cause any major outage. Also Read: Microsoft Users At High Risk: Indian Govt Recommends Updating Your Devices Now

What Happened

A DDoS attack works by flooding a server with an unusually large amount of traffic, leaving it too overloaded to respond to real users. In this case, Azure spotted the spike almost instantly and filtered the traffic in real time, which kept the website from going down. Also Read: Google Warns Users: Free Public Wi-Fi Isn’t As Safe As You Think

Microsoft said the attack reached 15.72 terabits per second and touched nearly 3.64 billion packets per second at its peak – the highest ever recorded for a cloud-based DDoS attempt. The previous record was a 6.3 Tbps attack that hit KrebsOnSecurity in June 2025. Also Read: Xbox Cloud Gaming Goes Live In India: How To Play Xbox Games Without A Console

The company added that the attack was multi-vector and focused on one endpoint in Australia, but did not name the website. Microsoft says its global mitigation setup helped keep services running normally during the attack.

Who Was Behind the Attack

According to Microsoft, the traffic came from the Aisuru botnet, a Turbo Mirai-class IoT botnet known for using compromised home routers and internet-connected cameras. These devices are often taken over when they run outdated software or have weak passwords. Many of the infected devices used in this attack were traced back to residential ISPs in the United States and other regions.

Technical details released by Microsoft show that the attack relied on extremely high-rate UDP floods directed at one public IP address. The traffic came from more than 500,000 IP sources worldwide. While the attack pushed sudden bursts of UDP packets to overwhelm the target, the low level of source spoofing helped Microsoft and internet providers trace it back quickly and enforce countermeasures.

Is There a Broader Risk

Microsoft says its cloud services remain protected. The company has advised businesses to ensure their internet-facing systems are properly secured and to run regular DDoS readiness checks. The reminder comes as internet activity typically spikes during the holiday season, a period when such attacks often increase.