Multiple waves of DDoS attacks disrupted North Korea’s public internet services this week, knocking major state websites offline.

Kentik’s internet analysis director Doug Madory linked the outages to sudden traffic floods from Vietnam, the Philippines, Venezuela, and other countries. The traffic began at 02:01 UTC on October 20, making the country’s websites unreachable.

The disruption affected more than 40 websites using North Korea’s .kp domain, including the Ministry of Foreign Affairs and the Korean Central News Agency.

Access remained unstable for roughly 32 hours. South Korean reporting indicated that services returned around 7 p.m. local time on October 21, after repeated downtime and brief recoveries.

North Korea Hit by Multiple DDoS Attacks

In Doug Madory public findings, Madory said aggregate traffic data showed several waves of incoming traffic rather than one continuous surge. That timing helped connect the website failures to a distributed denial-of-service attack, which overwhelms a target with traffic and prevents normal users from reaching it.

“This traffic all started at the same time, and it is coming from Vietnam and Venezuela. That’s definitely a DDoS attack,” Madory told Reuters, according to its report published by AsiaOne. Kentik cautioned that its analysis covered only part of the traffic heading toward North Korea.

The countries in the traffic records do not identify who ordered the attacks. Kentik has not identified the people responsible. Although compromised devices can generate traffic from many locations, no specific botnet has been publicly linked to this incident.

Madory’s accompanying observations identified repeated downtime affecting 175.45.176.0/24, a network block containing name servers for .kp domains.

These servers help translate website names into internet addresses. Their loss can leave multiple sites unreachable, even when individual web servers remain online.

His route observations also described changes involving North Korea’s AS131279 network. The 175.45.176.0/24 block moved from Cenbong to Russia’s TTK, while 175.45.178.0/24 switched to TTK before returning to Cenbong. The other two listed blocks retained their respective providers.

Those observations describe how traffic paths changed during the incident. They do not establish whether operators deliberately changed routes to reduce the attack’s impact.

Early coverage considered power problems or telecommunications faults as possible explanations. Kentik’s later findings added direct traffic evidence supporting a DDoS explanation.

However, the available reports do not identify the attack method, peak traffic volume, or tools used. Related reporting on the Dysphoria botnet explains how compromised routers and cameras can generate coordinated traffic floods.

For now, the strongest evidence is the close match between incoming traffic spikes and service failures. The incident shows why outage investigations need traffic measurements alongside website checks, while the attacker’s identity and the operation’s full scale remain unresolved.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Multiple Waves of DDoS Attacks Caused This Week’s Outage in North Korea appeared first on Cyber Security News.

Gear of War: E-Day players faced login failures, sudden disconnects, and other online service problems after distributed denial-of-service attacks targeted the game’s online services.

The official Gears Community account confirmed the cause on X, linking the disruption to DDoS activity and ending speculation about the source of the failures.

The Gears Community reported attacks on its online services that caused intermittent disconnects, login issues, and other disruptions, but did not identify the attackers, disclose traffic figures, or specify affected services, limiting details about the attack’s scale and method.

A separate update from the same account said the login issue had been resolved and that the team would continue closely monitoring services.

Earlier messaging had flagged extended login times and said the issue was improving. The updates show progress toward recovery, but the login fix should not be read as proof that every reported service problem had ended.

Gears of War: E-Day Hit by DDoS Attack

Players may experience delayed or failed logins, intermittent disconnections, and difficulty reconnecting, symptoms confirmed by the Gears Community during the online service disruption.

The available statement does not establish that the attacker accessed player accounts or stole personal information. It describes an attack against service availability. Reporting the incident as a confirmed data breach would go beyond the evidence released by the Gears Community team.

A DDoS attack uses multiple machines to overwhelm a target with traffic or requests. The aim is to make a system or network unavailable to legitimate users. Compromised devices can form a botnet, allowing attackers to send traffic from many sources at once, according to CISA’s DDoS response guidance.

This can exhaust network capacity or system resources, preventing the system from handling normal requests. However, the Gears update does not identify a botnet, a traffic flood type, or an attack rate. There is no published basis in that statement for assigning the incident to a known group or connecting it to another campaign.

Gaming infrastructure has faced similar availability threats before. Cybersecurity News previously covered DDoS malware targeting Valve Source Engine game servers, with several supported attack methods. That report provides useful background on game-server threats. However, it does not link to the E-Day disruption.

Another report examined a 3.15-billion-packets-per-second attack against a Minecraft server. The case shows why packet volume matters alongside bandwidth when assessing attacks. No comparable measurements have been shared in the available Gears statement.

CISA recommends confirming DDoS activity through network monitoring and traffic analysis, then applying measures such as traffic filtering and rate limits. These are general defensive steps, not confirmed details of the Gears team’s response.

Official updates confirm the reported cause, player impact, and login recovery, but leave the attack’s scale and technical handling undisclosed. The team’s stated recovery approach still includes monitoring after the service disruption.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Gears of War: E-Day Hit by DDoS Attack, Causing Login Failures and Disconnects appeared first on Cyber Security News.