When a major DDoS attack makes headlines, one question inevitably follows: “Which botnet was behind it?” In the current threat landscape, the most common suspect is Aisurua botnet that has recently made global news for several record-breaking 10+ Tbps attacks. As a result, any incident even remotely close to a terabit now prompts the reflexive question: “Was it Aisuru?”
The truth is that attributing a DDoS attack to a specific botnet is extraordinarily difficult, and often impossible. While popular narratives frame botnets as having unique fingerprints or recognisable tactics, the reality is far more complex.
Why Attribution Fails: No Unique Signatures
There is no consistent technical marker that reliably distinguishes one botnet from another. DDoS-for-Hire platforms typically provide the same toolbox of L3/L4 and L7 attack vectorsUDP floods, SYN floods, HTTP get/post floods, and more. The motifs of an attack are shaped not by the botnet’s identity, but by the attacker’s choices. Even if an attacker uses every vector available to them, that still doesn’t make the operation attributable. Many campaigns simply look the same.
Source IPs are an even weaker signal. Direct-path attacks rely on spoofed IPs, while reflection and amplification attacks leverage thousands of shared open relays. Multiple attackers using different botnets can easily end up sourcing their traffic from the exact same compromised infrastructure. Overlap becomes the norm rather than the exception.
Intentional “Branding” Muddying the Waters
In rare cases, DDoS-as-a-Service operators insert their botnet’s name or offensive slogans into packet payloads or URL fields. This is not for traceability it is pure marketing. When researchers later publish incident reports, the botnet receives free promotional coverage. But relying on such artefacts is a dead end: these signals are easy to spoof, and any copycat can replicate them to mislead attribution efforts.
A Real-World Example: A 1.5 Tbps Attack With No Clear Origin
Consider a recently analysed 1.5 Tbps attack. Most of the malicious packets were immediately dropped by simple UDP ACLs at cloud ingress. Only around 10 Mbps of TCP 300-byte packets passed through, with clean traffic peaking at 1.14 Gbps. Nothing about its characteristics suggested sophistication. Importantly, nothing in the PCAPs pointed to the identity of its creator.
Could it have been Aisuru? Possibly but so could dozens of other large botnets.
The Cloud Era Is Reshaping Attack Profiles
Modern botnets routinely exceed 1 Tbps. The recently exposed Shadow and Shadow V2 botnets, which leveraged compromised Amazon EC2 instances, demonstrate how easily attackers can weaponise cloud infrastructure for massive traffic volumes. After AWS experienced an outage, Shadow’s operators simply diversified, scanning for IoT devices to rebuild capacity. Criminal playbooks evolve fast and imitation among botnets is common.
Even attack duration is not a reliable clue. Aisuru’s largest attacks lasted under two minutes because they were likely operated directly by the botnet’s creators who ran the system at full throttle for maximum publicity. In contrast, paid-for attacks typically last longer 30 minutes to several days because subscribers get access only to a fraction of the botnet.
The Bottom Line
Attribution in DDoS is more guesswork than science. As bandwidth increases and attack tools become commoditised, distinguishing one botnet from another becomes nearly impossible. For defenders, the key is not identifying “who” but building systems that neutralise massive attacks regardless of origin.
