The botnet problem is far from over

The FBI’s attempt to “clean” 95,000 hacked devices and release them back to owners was meant to cripple botnet operations. Instead, it triggered what security experts call a digital feeding frenzy. Hackers quickly seized many of these newly freed machines, turning them into powerful tools for record-breaking cyberattacks.

At the center of this battle are botnets like Aisuru and ResHydra, sprawling networks of hijacked devices capable of crippling businesses, governments, and even entire nations.

What are botnets and why do they matter?

A botnet is a network of computers and internet-connected devices, smart TVs, routers, and even security cameras that have been infected with malware. Once compromised, these devices follow the commands of hackers, usually without the knowledge of their owners.

Botnets are used to:

• Launch distributed denial-of-service (DDoS) attacks that flood websites or servers with junk traffic.
• Spread ransomware or other malicious software.
• Run advertising fraud schemes by generating billions of fake clicks.

The danger lies in scale. One vulnerable device may not seem like much, but millions acting together can overwhelm even the best-defended digital systems.

Why the FBI’s cleanup backfired

When the FBI removed malware from tens of thousands of infected devices earlier this year, it inadvertently left those machines exposed. Many owners had not patched vulnerabilities or changed default settings, making them easy prey.

“It became a race to take them over as fast as possible,” said Damian Menscher, a Google security engineer.

The botnet group Aisuru won much of that race, seizing control of nearly a quarter of the “freed” machines. Within days, they unleashed the largest DDoS attack ever recorded—11.5 trillion bits per second of junk traffic, enough to overwhelm 50,000 household internet connections at once.

Aisuru: the stealth botnet built from everyday devices

Unlike older botnets that relied on hijacked personal computers, Aisuru thrives on “smart” devices.

• Routers, smart TVs, and security cameras are especially vulnerable.
• These devices stay online 24/7 but rarely receive updates.
• A single device can usually only belong to one botnet, making the FBI’s cleanup an open door for Aisuru to recruit them.

This approach makes Aisuru both stealthy and powerful. Owners are unlikely to notice anything wrong while their devices silently participate in cyberattacks.

Smart TVs: the surprising backbone of botnets

Smart TVs may seem like harmless home electronics, but they are increasingly weaponized.

• One botnet dismantled by Google in 2023 had 74,000 Android TV devices. By 2025, it had ballooned to 10 million, making it the largest known TV-based botnet.
• These devices were used in ad fraud schemes, clicking billions of ads for profit.
• Experts warn they could just as easily be used to launch ransomware campaigns or take down major websites.

In August 2025, a 22-year-old from Oregon was charged with running a botnet that temporarily knocked the social media platform X offline—proof that even top platforms are vulnerable.

From cybercrime to cyber warfare

The botnet threat isn’t limited to hackers chasing money. Governments are now deploying these networks as tools of cyber warfare.

• The UK accused Russia’s GRU of launching DDoS attacks on Ukrainian banks in 2022 using botnets, just before the full-scale invasion.
• ResHydra, another massive botnet built from tens of millions of devices, began as a fraud operation but has shifted to cyberattacks.

“Controlling a botnet of that scale could do extreme damage to a country,” warned Chris Formosa, a researcher with Lumen’s Black Lotus Labs.

Experts fear that if Aisuru and ResHydra were to grow further, or worse, combine forces, they could overwhelm even the defenses of tech giants like Google and Amazon.

What this means for you

You may unknowingly be part of a botnet. Devices most at risk include:

• Smart TVs and set-top boxes
• Wi-Fi routers
• Internet-connected security cameras
• Older smartphones and tablets

How to reduce your risk:

• Update firmware regularly. Many devices don’t auto-update by default.
• Change default passwords. Weak credentials are an open invitation.
• Use network monitoring tools. Look for unusual spikes in data usage.
• Unplug or reboot idle devices. This can break temporary connections to botnets.

Why this story matters

Botnets are no longer just a cybersecurity nuisance. They are a frontline weapon in global conflicts, capable of disrupting financial systems, cutting off communication, or even crippling internet access across countries.

The FBI’s well-intentioned cleanup shows the limits of law enforcement when everyday devices remain insecure. As more of our homes and workplaces rely on connected gadgets, the risks will only grow.

Cybersecurity, once the concern of IT departments, is now a matter of national defense and personal responsibility.