- Cloudflare stopped the largest recorded distributed denial-of-service (DDoS) attack, which peaked at 7.3 terabits per second (Tbps).
- The attack targeted a Hosting provider in mid-May 2025 and lasted just 45 seconds, delivering 37.4 terabytes of data.
- The DDoS event used a variety of attack methods, with 99.996% of the traffic coming from UDP flood attacks.
- More than 122,000 source IP addresses from 161 countries were involved, with significant traffic from Brazil, Vietnam, Taiwan, and China.
- Security researchers also reported that the RapperBot Malware has intensified operations, using DDoS threats to extort victims.
Cloudflare has stopped the largest distributed denial-of-service (DDoS) attack on record, which reached a peak of 7.3 terabits per second in mid-May 2025. The target of the attack was an unnamed hosting provider.
According to the company, the DDoS attack lasted 45 seconds and delivered a total of 37.4 terabytes of traffic. Cloudflare previously blocked large attacks in 2024 and early 2025, including a 5.6 Tbps incident aimed at an Asian internet service provider and a 6.5 Tbps assault that reportedly involved over 30,000 compromised webcams and video recorders.
The recent attack used multiple methods, such as UDP floods, QOTD reflection, echo reflection, NTP reflection, Mirai UDP floods, portmap floods, and RIPv1 amplification. UDP (User Datagram Protocol) flood is a technique that overwhelms servers with high volumes of data packets. “The 7.3 Tbps attack delivered 37.4 terabytes in 45 seconds,” stated Omer Yoachimik from Cloudflare. The attack targeted one IP address across an average of nearly 22,000 different destination ports every second, peaking at about 34,500.
Investigation showed that over 122,000 unique source IP addresses from 5,433 autonomous systems across 161 countries participated in the attack. The largest share of traffic came from Brazil’s Telefonica Brazil (AS27699) at 10.5%, followed by Viettel Group (AS7552) at 9.8%. Other major contributors included China Unicom (AS4837) and Chunghwa Telecom (AS3462).
This increase in volumetric DDoS activity has been matched by the ongoing presence of DDoS botnets like RapperBot. The QiAnXin XLab team reported that RapperBot targeted AI company DeepSeek in February 2025 and now demands “protection fees” to avoid DDoS attacks. Devices infected by RapperBot are found in several countries and industries. The malware spreads by attacking routers and storage devices with weak passwords, then communicates with remote servers using encrypted DNS TXT records to get new attack orders.
RapperBot’s activities have targeted over 100 systems daily, with more than 50,000 infected devices observed. These campaigns impact sectors such as public management, financial services, and manufacturing.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Crypto Casino Luckio Pays Influencers $500K/Month Amid Red Flags
- Parataxis Launches Bitcoin Treasury Platform in South Korea
- Iran TV Hacked Amid $90M Crypto Heist in Escalating Cyber War
- Senate Passes GENIUS Act; State Regulators Warn of Banking Risks
- ICP’s Chain Fusion Unlocks Native Bridge to Solana, Bitcoin, Ethereum
