“OVHcloud found nearly 100,000 Mikrotik devices that are reachable/exploitable over the internet, making up for many potential targets for DDoS actors.”
The April attack hit about 840 million packets per second from just 5,000 source IPs. Those were MikroTik core routers with 36-core CPUs, exposed admin interfaces and old firmware. OVHcloud says 1 percent of the exposed fleet would push 2.28 billion packets per second. Someone bought high-end core routers, left them online and never updated them. Everyone else eats the traffic.