Multiple DDoS waves knock over 40 North Korean .kp websites offline for about 32 hours
Multiple waves of DDoS attacks disrupted North Korea's internet infrastructure starting 2026-10-20 at about 02:01 UTC, intermittently taking more than 40 official .kp websites offline for roughly 32 hours. Kentik linked the outages to synchronized inbound traffic surges. Affected sites included the Ministry of Foreign Affairs, KCNA, Rodong Sinmun, Naenara and Air Koryo. No perpetrator has been identified, and the countries the traffic came from should not be assumed to represent governments or operators there. SBS reported that 42 major .kp sites had stabilized around 7 p.m. on October 21.
Detalhes técnicos
- Doug Madory (Kentik) observed heavy flows from Vietnam, the Philippines, Venezuela and other countries, all starting at the same time. Kentik saw only a portion of the traffic, so the full scale is unknown.
- Address block 175.45.176.0/24, which hosts name servers for the .kp domain, suffered repeated outages. DNS infrastructure was therefore as affected as the websites themselves.
- KCNA was offline for 19 of the first 24 hours. Other sites had only brief windows of connectivity, which points to repeated interruptions rather than one continuous shutdown. NK News also reported interruptions to the Silibank SMTP email server.
- Routing changes were seen on North Korea's AS131279 during the attacks:
- 175.45.176.0/24 switched from Cenbong to the Russian provider TTK.
- 175.45.177.0/24 continued using TTK.
- 175.45.178.0/24 moved from Cenbong to TTK, then back to Cenbong.
- 175.45.179.0/24 continued using Cenbong.
- It is unclear whether these routing changes were deliberate defensive measures or the result of connectivity problems.
- Attack bandwidth, packet rates, transport protocols and any use of amplification techniques have not been reported.
- Earlier explanations for the outages had included power instability, telecommunications faults and maintenance.
Linha do tempo
-
Multiple DDoS waves knock over 40 North Korean .kp websites offline for about 32 hours
ler a análise desta fonte ocultar
Multiple waves of DDoS attacks disrupted North Korea's internet infrastructure starting 2026-10-20 at about 02:01 UTC, intermittently taking more than 40 official .kp websites offline for roughly 32 hours. Kentik linked the outages to synchronized inbound traffic surges. Affected sites included the Ministry of Foreign Affairs, KCNA, Rodong Sinmun, Naenara and Air Koryo. No perpetrator has been identified, and the countries the traffic came from should not be assumed to represent governments or operators there. SBS reported that 42 major .kp sites had stabilized around 7 p.m. on October 21.
Technical Details
- Doug Madory (Kentik) observed heavy flows from Vietnam, the Philippines, Venezuela and other countries, all starting at the same time. Kentik saw only a portion of the traffic, so the full scale is unknown.
- Address block 175.45.176.0/24, which hosts name servers for the .kp domain, suffered repeated outages. DNS infrastructure was therefore as affected as the websites themselves.
- KCNA was offline for 19 of the first 24 hours. Other sites had only brief windows of connectivity, which points to repeated interruptions rather than one continuous shutdown. NK News also reported interruptions to the Silibank SMTP email server.
- Routing changes were seen on North Korea's AS131279 during the attacks:
- 175.45.176.0/24 switched from Cenbong to the Russian provider TTK.
- 175.45.177.0/24 continued using TTK.
- 175.45.178.0/24 moved from Cenbong to TTK, then back to Cenbong.
- 175.45.179.0/24 continued using Cenbong.
- It is unclear whether these routing changes were deliberate defensive measures or the result of connectivity problems.
- Attack bandwidth, packet rates, transport protocols and any use of amplification techniques have not been reported.
- Earlier explanations for the outages had included power instability, telecommunications faults and maintenance.