Multiple Waves of DDoS Attacks Caused This Week’s Outage in North Korea

Multiple waves of DDoS attacks disrupted North Korea’s public internet services this week, knocking major state websites offline.

Kentik’s internet analysis director Doug Madory linked the outages to sudden traffic floods from Vietnam, the Philippines, Venezuela, and other countries. The traffic began at 02:01 UTC on October 20, making the country’s websites unreachable.

The disruption affected more than 40 websites using North Korea’s .kp domain, including the Ministry of Foreign Affairs and the Korean Central News Agency.

Access remained unstable for roughly 32 hours. South Korean reporting indicated that services returned around 7 p.m. local time on October 21, after repeated downtime and brief recoveries.

North Korea Hit by Multiple DDoS Attacks

In Doug Madory public findings, Madory said aggregate traffic data showed several waves of incoming traffic rather than one continuous surge. That timing helped connect the website failures to a distributed denial-of-service attack, which overwhelms a target with traffic and prevents normal users from reaching it.

“This traffic all started at the same time, and it is coming from Vietnam and Venezuela. That’s definitely a DDoS attack,” Madory told Reuters, according to its report published by AsiaOne. Kentik cautioned that its analysis covered only part of the traffic heading toward North Korea.

The countries in the traffic records do not identify who ordered the attacks. Kentik has not identified the people responsible. Although compromised devices can generate traffic from many locations, no specific botnet has been publicly linked to this incident.

Madory’s accompanying observations identified repeated downtime affecting 175.45.176.0/24, a network block containing name servers for .kp domains.

These servers help translate website names into internet addresses. Their loss can leave multiple sites unreachable, even when individual web servers remain online.

His route observations also described changes involving North Korea’s AS131279 network. The 175.45.176.0/24 block moved from Cenbong to Russia’s TTK, while 175.45.178.0/24 switched to TTK before returning to Cenbong. The other two listed blocks retained their respective providers.

Those observations describe how traffic paths changed during the incident. They do not establish whether operators deliberately changed routes to reduce the attack’s impact.

Early coverage considered power problems or telecommunications faults as possible explanations. Kentik’s later findings added direct traffic evidence supporting a DDoS explanation.

However, the available reports do not identify the attack method, peak traffic volume, or tools used. Related reporting on the Dysphoria botnet explains how compromised routers and cameras can generate coordinated traffic floods.

For now, the strongest evidence is the close match between incoming traffic spikes and service failures. The incident shows why outage investigations need traffic measurements alongside website checks, while the attacker’s identity and the operation’s full scale remain unresolved.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Multiple Waves of DDoS Attacks Caused This Week’s Outage in North Korea appeared first on Cyber Security News.