Microsoft Blocks Largest-Ever Cloud DDoS Attack Aimed At Australian Website: Here’s What Happened

Microsoft has disclosed that it stopped what it calls the largest cloud-based Distributed Denial-of-Service (DDoS) attack recorded to date. The attack targeted a single website in Australia and was picked up by Microsoft’s Azure DDoS Protection system. The company says the incident happened on October 24, 2025, and that Azure stepped in automatically before the attack could cause any major outage. Also Read: Chrome Extension With Google “Featured” Badge Secretly Captured ChatGPT And Gemini Chats

What Happened

A DDoS attack works by flooding a server with an unusually large amount of traffic, leaving it too overloaded to respond to real users. In this case, Azure spotted the spike almost instantly and filtered the traffic in real time, which kept the website from going down. Also Read: Android Phones Hit By New DroidLock Malware That Locks Users Out And Demands Ransom

Microsoft said the attack reached 15.72 terabits per second and touched nearly 3.64 billion packets per second at its peak – the highest ever recorded for a cloud-based DDoS attempt. The previous record was a 6.3 Tbps attack that hit KrebsOnSecurity in June 2025. Also Read: Govt Seeks Clarification From Apple As ‘Mercenary’ Spyware Threat Alerts Reach Users In India

The company added that the attack was multi-vector and focused on one endpoint in Australia, but did not name the website. Microsoft says its global mitigation setup helped keep services running normally during the attack.

Who Was Behind the Attack

According to Microsoft, the traffic came from the Aisuru botnet, a Turbo Mirai-class IoT botnet known for using compromised home routers and internet-connected cameras. These devices are often taken over when they run outdated software or have weak passwords. Many of the infected devices used in this attack were traced back to residential ISPs in the United States and other regions.

Technical details released by Microsoft show that the attack relied on extremely high-rate UDP floods directed at one public IP address. The traffic came from more than 500,000 IP sources worldwide. While the attack pushed sudden bursts of UDP packets to overwhelm the target, the low level of source spoofing helped Microsoft and internet providers trace it back quickly and enforce countermeasures.

Is There a Broader Risk

Microsoft says its cloud services remain protected. The company has advised businesses to ensure their internet-facing systems are properly secured and to run regular DDoS readiness checks. The reminder comes as internet activity typically spikes during the holiday season, a period when such attacks often increase.