Law enforcement agencies from the U.S., Germany, and Canada have dismantled the infrastructure used to control and command the Aisuru, KimWolf, JackSkid, and Mossad botnets, which infected IoT devices.

This coordinated law enforcement effort also targeted virtual servers, internet addresses, and other resources utilized by these four botnets to carry out hundreds of thousands of large-scale DDoS attacks globally in recent months. Victims included IP addresses belonging to the Defense Department’s network.

For example, in December, the Aisuru botnet achieved a new high with a DDoS assault reaching 31.4 Tbps and 200 million requests per second, targeting multiple organizations, largely in the telecom industry.

Aisuru was also responsible for a prior DDoS record of 29.7 Tbps, while Microsoft linked an incident with 500,000 IP addresses to the same botnet, which peaked at 15.72 Tbps in November.

“This operation, along with other coordinated international actions, aims to disrupt communication linked to the Aisuru, KimWolf, JackSkid, and Mossad botnets, preventing further victim devices from being infected and limiting or eliminating the botnets’ ability to launch future attacks,” according to the Justice Department.

“Court documents show that the Aisuru botnet sent over 200,000 DDoS command instructions, KimWolf botnet sent more than 25,000, JackSkid botnet sent more than 90,000, and Mossad botnet sent upward of 1,000 DDoS command attacks.”

The U.S. Justice Department reports these combined botnets infected more than three million IoT devices, including webcams, DVRs, and WiFi routers, many located within the U.S.

The botnet operators commercialized the access to various cybercriminals under a service business model, enabling them to conduct DDoS attacks that led to tens of thousands of dollars in both financial loss, as well as remediation expenses.

“These attacks can severely affect fundamental internet infrastructure, produce considerable performance degradation for ISPs and their clients, and overwhelm even the large-capacity, cloud-based mitigation service,” stated the cybersecurity company Akamai, which was one of the involved private businesses for the united action.

“Cybercriminals utilized these botnets to launch hundreds of thousands of attacks, and in some cases asked victims for ransom payments.”