Meris, a new distributed denial-of-service (DDoS) botnet that is believed to obtain its power from tens of thousands of compromised networking devices, has been targeting Russian internet giant Yandex over the past month and the attack has officially broken the DDoS record with 21.8 million requests per second. This DDoS attack was first reported in the Russian media this week in which it is described as “the largest in the history of the Russian internet” (aka RuNet) and Yandex, along with its partner Qrator Labs, have begun research into the incident. Yandex observed that the attack on its servers involved approximately 56,000 attacking hosts but estimate, through indications identified in their research, that the number of compromised devices may be near 250,000 overall. In a report published this week, Qrator Labs explained that the majority of the attack traffic led back to devices from MikroTik, which is a Latvian network equipment manufacturer, but was unable to determine if a zero-day vulnerability was exploited in MikroTi9k’s software or if the actor was utilizing a past exploit. MikroTik provided a statement to TheRecord, saying that “these attacks use the same routers that were compromised in 2018, when MikroTik RouterOS had a vulnerability” and that there are currently no new vulnerabilities in those devices. Yandex and Qrator Labs, however, identified that there is a great range in RouterOS versions in the Meris botnet attacks and includes devices running the newer firmware versions. The Meris botnet DDoS attack on Yandex is still evolving, and CTAPT will provide updates as they become available.