A distributed denial-of-service (DDoS) attack, which floods a network with junk traffic, caused this week’s internet outages in North Korea, according to Doug Madory, director of internet analysis at the network monitoring company Kentik. “Multiple waves of DDoS attacks caused this week’s outage in North Korea,” he wrote on X at 17:42 BST on 22 October.
Madory said a flood of traffic from Vietnam, the Philippines, Venezuela “and other countries” began at 02:01 UTC on 20 October, or 03:01 BST and just after 11:00 in Pyongyang, at the moment the country’s websites went offline. The disruption lasted about 32 hours, Reuters reported, citing Kentik.
The story is about measurement as much as about the outage. Kentik’s data shows when the traffic arrived and where it came from, but, Madory told Reuters, it “does not indicate who the perpetrators are”, and the company saw only part of the traffic heading into North Korea. South Korean media have also pointed to the country’s unreliable power supply as a possible cause.
In brief
- What happened: Kentik says waves of DDoS traffic hit North Korea from 20 October, coinciding with outages that took most of its websites offline for about 32 hours.
- Why it matters: Outside monitors have tied a nationwide North Korean outage to measured traffic data, rather than leaving the cause to guesswork.
- What’s unknown: Who sent the traffic, how large it was, and how much of it Kentik could see.
Kentik’s chart shows traffic flat for five days, then a sudden spike
Madory’s post included a Kentik chart titled “Traffic to North Korea by unique source ASN”, plotting hourly traffic into the country from 15 to 22 October. The line is flat until 20 October, when it jumps sharply at a point marked “Traffic spike begins 02:01 UTC, Oct 20”. It then falls back in stages through 21 October and has largely subsided by 22 October. The chart’s axis gives no traffic volumes.
“This traffic all started at the same time and it is coming from Vietnam and Venezuela. That’s definitely a DDoS (Distributed Denial-of-Service) attack,” Madory told Reuters.
A day earlier, at 14:50 BST on 21 October, Madory had reported that “Nearly all North Korean websites have been inaccessible for the past day”. He added that “175.45.176.0/24 contains the name servers for .kp and has been down repeatedly in the past 24hrs.” That block of 256 addresses holds the servers that tell the rest of the internet where any .kp website lives.
State media and the foreign ministry were among more than 40 sites hit
North Korea-focused outlet NK News reported on 21 October that “Around 11 a.m. KST on Tuesday, multiple websites started facing persistent outages simultaneously”, including those of the Korean Central News Agency (KCNA) and the Rodong Sinmun and Minju Joson newspapers.
According to South Korean media cited by Reuters, the outages hit “more than 40 official sites using the country’s .kp domain”, including the foreign ministry and KCNA.
Independent outage data shows a similar pattern of about 31 hours
Data from IODA, the internet outage detection project at Georgia Tech, points the same way. Its routing signal for North Korea dropped below its normal level at 03:30 BST on 20 October, then flickered between normal and critical in short cycles until it settled at 10:30 BST on 21 October. A further 15-minute dip followed at 02:55 BST on 22 October.
IODA measures whether the country’s networks remain reachable rather than what is hitting them, so it confirms the timing and on-off character of the outage without saying anything about its cause.
Reuters said the outage appeared unrelated to the wider fallout from the disclosure of critical PHP flaws. North Korea has gone dark before: in late 2014, after the Sony Pictures controversy, the country suffered an hours-long complete internet outage, Reuters noted.
Traffic sources show where packets came from, not who sent them
Madory’s list of source countries is a description of the traffic, not a finding about its author. Kentik’s own caveat, that its data “does not indicate who the perpetrators are”, is the most important line in the coverage, and the reason Vietnam, the Philippines and Venezuela should be read as routes rather than suspects.
The partial view matters too. Reuters reported that Kentik analysed only a portion of the traffic, so the shape of its chart is a strong signal but not a full measurement, and nobody has published the attack’s size.
A single address block made the outage easy to spot and hard to absorb
The 21 October post explains why so many sites fell together. When one /24 block carrying the .kp name servers goes down repeatedly, every site under the country domain becomes unreachable at once, regardless of the individual web servers. That concentration also makes the failure easy for outside monitors to see: Kentik, IODA and NK News each put the start within about half an hour of 11:00 Pyongyang time.
The power-supply explanation from South Korean media has not been ruled out, and the two causes are not mutually exclusive. What would settle it is fuller traffic data from other monitors. Until then, the questions for watchers are whether the traffic returns and whether North Korea’s state media comment on an outage that, on Kentik’s data, began at 03:01 BST on 20 October. TSN tracks attacks like this on its Ransomware & Cyber Attacks hub; Kentik also documented a route-hijack case cited in TSN’s recent report on routing security.
Sources
- Doug Madory (Kentik) on X, 22 Oct 2026
- Doug Madory (Kentik) on X, 21 Oct 2026
- IODA: North Korea country dashboard
- The Straits Times (Reuters): North Korean internet was hit by DDoS cyberattack, network monitoring firm says
- NK News: Nearly all North Korean websites go offline in mysterious outage
Related stories
- RPKI Now Protects About 70% of Internet Routes, Up From 54% a Year Ago, IPinfo Finds
- US Charges 14 People Over Alleged North Korean IT Worker Scheme and Raids Texas “Laptop Farms”
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
