Canonical suffered its second DDoS attack this year, disrupting public websites for over four hours while Launchpad and the Snap Store remained online.

Ubuntu’s parent company Canonical spent part of last week fighting off a sustained distributed denial of service (DDoS) attack, the second one to hit its infrastructure this year. The company revealed the attack on October 8 through a post on the Ubuntu Discourse forum.

“Canonical’s websites are under a sustained distributed denial of service attack. Our team is working diligently to resolve the incident. Please refer to our status page for up-to-date information. Some services may be intermittently unavailable.” the company states.

At this time, no cybercrime or hacktivist group has claimed responsibility

The attack affected Canonical’s main public websites, including ubuntu.com, canonical.com, the Ubuntu blog, the developer portal, and the security advisory pages and API. Users may have been unable to access security advisories or read the blog during the attack.

“It was recently revealed that Canonical’s web infrastructure and the Ubuntu ecosystem suffered a massive and sustained distributed denial-of-service (DDoS) attack that caused its main portals and services to crash and be intermittent for more than four hours.” states the company blog. “Regarding the attack, it is mentioned that it directly affected the most visible institutional domains, including canonical.com and ubuntu.com, as well as the official blog, the developer portal, assets.ubuntu.com, academy.canonical.com and sites linked to enterprise technologies such as jaas.ai and maas.io.”

However, Launchpad and the Snap Store remained online throughout the incident. These services allow developers and system administrators to manage and install software.

Canonical acknowledged the outage on its status page and Ubuntu Discourse while engineers worked to limit the impact. The attack temporarily disrupted the Ubuntu Security API and Livepatch services, affecting tools used to check security advisories and apply kernel patches without restarting systems. However, Canonical’s distributed infrastructure helped contain the damage. Software repositories and mirror servers remained available, allowing users to install updates. Launchpad, the Snap Store, disk image servers and Ubuntu Single Sign-On also continued to work.

As a result, users could continue downloading and installing packages even while Canonical’s public websites were disrupted.

The overall outage lasted a little over four hours, causing real disruption.

This attack differs from the April one, which caused greater disruption by taking down Launchpad and the Snap Store and preventing some users from installing Ubuntu updates. At the time, a hacktivist group called The Islamic Cyber Resistance in Iraq, also known as 313 Team, claimed responsibility.

Canonical described the April incident as a sustained, cross-border attack, language that suggested distributed infrastructure spanning multiple countries. Whether this October attack is a continuation of the same campaign or a completely unrelated actor piling on is genuinely unclear.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, DDoS) 

Italy’s Foreign Ministry is defending its website against a cyberattack, checking embassy sites and pushing for EU action to identify attackers.

On the morning of October 8, Italy’s Ministry of Foreign Affairs said its website was being attacked. According to the ministry’s own statement, its protection systems have mitigated the attack so far, with no disruption. The statement doesn’t say who is behind it, or what kind of attack it is.

The ministry is monitoring the situation with the Polo Strategico Nazionale, the country’s national cloud hub, and with the competent authorities.

“Cybersecurity is a central element of the reform of the Foreign Ministry approved last year. In recent months, we have strengthened our capabilities to prevent, monitor and respond to threats, adopting all necessary countermeasures, including on the technological side,” Foreign Minister Antonio Tajani said.

“Tajani had also had the opportunity to explain the technical capabilities of the CSIRT Operations Room to German Foreign Minister Johann Wadephul during his recent visit to Rome.” “In this context, Italy has decided to work with Romania and other EU member states to include proposals in upcoming European meetings to designate the actors responsible for cyberattacks, including attacks targeting Italian institutions.” reads the statement published by Italy’s Foreign Ministry.

Analysts are also checking the websites of Italian embassies and consulates abroad for similar attempts. That detail matters, and I’ll come back to it.

Minister Antonio Tajani tied the response to last year’s reform of the Farnesina, which made cybersecurity a central piece. He said prevention, monitoring and response capabilities have been strengthened in recent months, including on the technology side.

The statement ends on diplomacy. Italy will work with Romania and other member states to put proposals on the agenda of upcoming EU meetings, aimed at naming those responsible for cyberattacks, including attacks on Italian institutions. A blocked page is forgotten in a day, while a name on an official list is harder to shrug off.

Nobody has claimed this attack, but the pattern is familiar. NoName057(16) is a pro-Russian group that declared itself in March 2022 and announces its targets on Telegram. Avast researchers saw it using the Bobik botnet for DDoS attacks as early as September 2022.

Later, the DDoSia Project (aka DDosia), a crowdsourced DDoS operation linked to the pro-Russian hacktivist group NoName057(16), made the headlines beacuse its involvement in DDoS attacks again governments that supported Ukraine.

Italy has been a regular target. Over a weekend in January 2025, as Zelensky visited Rome, the group hit ministries and government sites on Saturday, then banks including Intesa and Monte dei Paschi di Siena and the ports of Taranto and Trieste on Sunday. At the end of December 2024 it had gone after Malpensa and Linate airports, and in February 2025 it tied a new wave to a speech by President Mattarella, according to Infosecurity Magazine. The timing follows politics, which isn’t a coincidence.

The ministry itself has been here before. ANSA reported that Russian hackers took its website down in late December 2024, and Tajani said it was back up the next day. DDoS attacks hit availability, not data, so the site goes dark and comes back. A loud attack can also pull attention away from a quiet one, which is a reason to look closer, not a claim about this case.

Now the embassies, and this part is my analysis. A ministry homepage going dark is embarrassing. An embassy or consulate site going dark is a problem for real people, because it’s where citizens abroad look for appointments, contacts and instructions, and the worst moment for an outage is a crisis abroad. Every one of those sites is also a surface to defend, and a lookalike page is an easy way to scam someone who’s already stressed.

Giving a look to the list of targets shared on DDosia today I can confirm that administrators planned attacks against the Farnesina, five Italian embassy sites, several Interior and Defence Ministry services, and other Italian organizations.

• attiva.fastweb.it
• sind.it
• whs.activenetwork.it
• bp.activenetwork.it
• sistemagalileo.it
• www.activenetwork.it
• webtop.we-com.it
• www.fastweb.it
• agenzie.interno.gov.it
• ambbruxelles.esteri.it
• ambbucarest.esteri.it
• ambcopenaghen.esteri.it
• ambdublino.esteri.it
• ambhelsinki.esteri.it
• concorsi.difesa.it
• constoronto.esteri.it
• idserver.servizicie.interno.gov.it
• sondaggi.bimedia.it
• www.aeronautica.difesa.it
• www.cartaidentita.interno.gov.it
• www.esteri.it
• www.giorgiameloni.it
• www.istitutospiov.it
• www.marina.difesa.it
• www.prenotazionicie.interno.gov.it
• www.uni.com

There is a precedent. In 2017, The Guardian reported a months-long intrusion into the Foreign Ministry’s systems. Italian media later reported that the attackers had targeted staff email accounts at the ministry and Italian embassies, rather than the encrypted system used for sensitive communications. A senior ministry security official said that attacks often happen before important events for Italy, while the Kremlin denied any involvement.

That’s why checking embassy websites is more than routine work. If someone wants to damage Italy’s image at little cost, the diplomatic network offers a large and highly visible target. The ministry is responding by strengthening its technical defenses and pushing at the EU level for “proposals to designate actors responsible for cyber attacks”, as the Farnesina’s statement puts it. That could make attribution more costly for attackers than simply taking a website offline.

DDoS attacks should not be underestimated, especially when they target government institutions and diplomatic services. They can disrupt public services, create pressure and attract significant media attention. But from a technical perspective, they are not usually complex offensive operations for a state to neutralize, especially when the target has adequate DDoS protection and network capacity.

The more important question is what sits behind the noise. Authorities need to determine whether these attacks are simply disruptive actions designed to attract attention, or whether they are being used to distract defenders while more sophisticated operations take place elsewhere. If there is no evidence of intrusion, data theft or compromise, the DDoS activity may be little more than a public demonstration of intent.

That distinction matters because a long list of targets can create the impression of a much more serious threat than the technical impact actually suggests. For people outside the cybersecurity community, a website being attacked can easily be interpreted as evidence that a government has been seriously compromised. In reality, it may be a relatively simple operation whose main objective is visibility.

The risk, therefore, is not only the attack itself, but the narrative built around it. DDoS campaigns can become a useful propaganda tool, creating fear and uncertainty while requiring relatively limited technical resources. The challenge for governments is to defend against the disruption without giving a sterile attack more strategic value than it deserves, while at the same time making sure that the noise is not hiding something more serious.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Italy’s Foreign Ministry)

The DOJ seized domains behind NightmareStresser, a DDoS-for-hire service tied to hundreds of thousands of attacks since 2022, as part of Operation PowerOFF.

Renting a DDoS attack used to be as easy as renting a movie. Pick a target, pay a few dollars, watch the site go dark. The Justice Department just made that a little harder by seizing the domains behind NightmareStresser, one of the longest-running services in that business.

“The Justice Department today announced the court-authorized seizure of internet domains associated with one of the world’s longest running Distributed Denial of Service (DDoS) for-hire services known as “NightmareStresser.” ” states DoJ.

“Federal law enforcement has seized websites maintained by criminal service providers that allow paying customers to launch powerful DDoS attacks targeting victims in the District of Alaska and worldwide as part of coordinated actions to disrupt so called “Booter” or “Stresser” operators.”

The announcement came from the District of Alaska, which may seem like an unusual place for a DDoS takedown. But Anchorage prosecutors have been investigating and fighting DDoS-for-hire services for almost a decade.

Federal authorities seized the websites under a court-approved warrant, preventing customers from using the service to launch attacks against targets in Alaska and around the world. These services are often called “booters” or “stressers,” names that make renting a DDoS attack sound like a simple online service.

It’s tempting to file DDoS attacks under “annoying but harmless.” The DOJ’s own description of the victim pool argues otherwise.

“Booter services such as those named in this action allegedly facilitate attacks on a wide array of victims in the United States and abroad, including educational institutions, government agencies, gaming platforms and millions of people. In addition to affecting targeted victims, these attacks can significantly degrade internet services and can completely disrupt internet connections.” continues DoJ. “According to the seizure warrant affidavit, the NightmareStresser Booter service targeted in this operation was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide since 2022. “

A school district losing internet access during exam week, a city government portal going dark, a gaming server getting flooded mid-match: none of that is abstract to the people dealing with it in the moment.

These attacks can slow down internet services or completely take them offline. The impact can also go beyond the main target, affecting other users and services that rely on the same network infrastructure.

NightmareStresser wasn’t a small operation running a handful of scripts for hobbyists.

“According to the seizure warrant affidavit, the NightmareStresser Booter service targeted in this operation was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide since 2022.” states DoJ.

That’s over three years of near-continuous rental attacks, on a service that markets itself with a name straight out of a horror movie.

The FBI’s Anchorage Field Office ran the technical side with help from the Royal Canadian Mounted Police’s Federal Policing Northwest Region. It’s a reminder that DDoS-for-hire crime doesn’t respect borders, so neither does the response to it.

This seizure sits inside Operation PowerOFF, the ongoing international campaign that’s been dismantling DDoS-for-hire infrastructure and going after the people running it for years. Just this past April, a coordinated action across 21 countries took down 53 domains, arrested four operators, and sent warning letters to more than 75,000 identified users of these platforms. Before that, in December 2024, another PowerOFF sweep knocked out 27 booter sites in one go.

Alaska’s own contribution to that broader effort goes back further than most people would guess.

“In previous law enforcement actions involving prosecutors and investigators in Anchorage and Los Angeles over the last eight years, the Justice Department charged twelve defendants who facilitated DDoS-for hire services and seized more than 100 internet domains associated with DDoS-for-hire services.” continues DoJ. “The multi-prong investigation announced today builds on the success of the prior cases by targeting all known booter sites, shutting down as many as possible, and undertaking a public education campaign.”

Twelve people and a hundred domains later, they’re still finding new ones to shut down.

Booter services are difficult to eliminate completely. When one is taken down, another can quickly appear, often using similar business models. The DOJ says these services have continued to grow because they make it easy for people with little technical knowledge to launch DDoS attacks.

Users don’t need to write code or understand how networks work. They can simply visit a website, pay for the service, often using cryptocurrency, and choose their target. This low barrier to entry has made DDoS-for-hire services accessible to a much wider group of cybercriminals.

Assistant U.S. Attorneys Adam Alexander and Ainsley McNerney are prosecuting the case out of the District of Alaska. The DOJ was explicit that this investigation isn’t a one-off strike but part of a wider plan to target every known booter site it can find, shut down as many as possible, and keep running public education alongside the legal action.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Operation PowerOFF)