Multiple waves of DDoS attacks disrupted North Korea’s internet infrastructure this week, intermittently knocking over 40 official websites offline for about 32 hours.
Network monitoring company Kentik linked the outages to synchronized surges of inbound traffic that began on October 20, 2026.
Doug Madory, Kentik’s director of internet analysis, noted that aggregate traffic data showed heavy flows originating from Vietnam, the Philippines, Venezuela, and other countries. The traffic surge began around 02:01 UTC, when North Korean websites became inaccessible.
“This traffic all started at the same time and is coming from Vietnam and Venezuela. That’s definitely a DDoS attack,” Madory told Reuters. However, Kentik observed only a portion of the traffic directed toward North Korea, limiting visibility into the incident’s full scale.
North Korea State Websites Affected
The disruption impacted websites using North Korea‘s .kp country-code top-level domain, including the Ministry of Foreign Affairs, the Korean Central News Agency, Rodong Sinmun, Naenara, and the national airline Air Koryo. NK News also reported interruptions affecting the Silibank SMTP email server.
Monitoring indicated that KCNA was offline for 19 of the first 24 hours after the disruption began. Other affected websites experienced only brief windows of connectivity, suggesting repeated interruptions rather than a single continuous shutdown across all services.
In his technical analysis, Madory identified the address block 175.45.176.0/24, which contains name servers for the .kp domain, and reported repeated outages affecting that range. This meant that the domain-name infrastructure was as critical to the disruption as website availability.
Madory also documented routing changes involving North Korea’s AS131279 network during the attacks. His observations showed different behaviors across four adjacent address blocks:
- 175.45.176.0/24 switched from Cenbong to the Russian provider TTK but remained routed through Russia.
- 175.45.177.0/24 continued using TTK.
- 175.45.178.0/24 moved from Cenbong to TTK, then back to Cenbong.
- 175.45.179.0/24 continued using Cenbong.
These observations confirm that routing changed during the incident, but do not clarify whether these changes were deliberate defensive measures or the result of connectivity issues.
South Korean broadcaster SBS reported that 42 major .kp websites had returned to stable operation around 7 p.m. on October 21, following roughly 32 hours of disruption. Earlier reports had considered power instability, telecommunications faults, and maintenance as possible explanations for the outages.
Kentik’s subsequent traffic analysis reinforced the assessment of a DDoS attack but did not identify the perpetrators. The countries associated with the observed traffic should not be assumed to represent the governments or operators in those locations.
Additionally, the available reports do not specify attack bandwidth, packet rates, transport protocols, or whether amplification techniques were used, leaving several important technical details unresolved.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
