Bu hafta DDoS hujumlarining bir necha to'lqini Shimoliy Koreyaning internet infratuzilmasini buzdi va 40 dan ortiq rasmiy veb-saytni taxminan 32 soat davomida vaqti-vaqti bilan oflayn qildi.
Tarmoq monitoring kompaniyasi Kentik uzilishlarni 2026-yil 20-oktabrda boshlangan sinxronlashtirilgan kiruvchi trafik to'lqinlari bilan bog'ladi.
Kentikning internet tahlili direktori Dug Madory agregat trafik ma'lumotlari Vetnam, Filippin, Venesuela va boshqa mamlakatlardan kelgan og'ir oqimlarni ko'rsatganini ta'kidladi. Trafik to'lqini taxminan 02:01 UTC atrofida boshlandi, shunda Shimoliy Koreya veb-saytlari kirish mumkin bo'lmay qoldi.
"Bu trafikning barchasi bir vaqtda boshlandi va Vetnam hamda Venesueladan kelmoqda. Bu aniq DDoS hujumi," — dedi Madory Reutersga. Biroq Kentik Shimoliy Koreyaga yo'naltirilgan trafikning faqat bir qismini kuzatdi, bu esa hodisaning to'liq ko'lamini ko'rishni chekladi.
Ta'sirlangan Shimoliy Koreya Davlat Veb-saytlari
Buzilish Shimoliy Koreyaning .kp mamlakat kodi yuqori darajali domenidan foydalanadigan veb-saytlarga ta'sir qildi, jumladan Tashqi ishlar vazirligi, Koreya Markaziy Axborot Agentligi, Rodong Sinmun, Naenara va milliy aviakompaniya Air Koryo. NK News shuningdek Silibank SMTP elektron pochta serveridagi uzilishlar haqida ham xabar berdi.
Monitoring shuni ko'rsatdiki, KCNA buzilish boshlanganidan keyingi dastlabki 24 soatning 19 soatida oflayn edi. Boshqa ta'sirlangan veb-saytlar faqat qisqa ulanish oynalarini ko'rsatdi, bu esa barcha xizmatlar bo'yicha bitta uzluksiz o'chirish emas, balki takroriy uzilishlarni anglatadi.
O'zining texnik tahlilida Madory .kp domeni uchun nom serverlarini o'z ichiga olgan 175.45.176.0/24 manzil blokini aniqladi va shu diapazonga ta'sir qilgan takroriy uzilishlar haqida xabar berdi. Bu shuni anglatadiki, domen nomlari infratuzilmasi veb-sayt mavjudligi kabi buzilishda muhim rol o'ynadi.
Madory shuningdek hujumlar paytida Shimoliy Koreyaning AS131279 tarmog'i bilan bog'liq marshrutlash o'zgarishlarini hujjatlashtirdi. Uning kuzatishlari to'rtta qo'shni manzil bloklari bo'yicha turli xatti-harakatlarni ko'rsatdi:
- 175.45.176.0/24 Cenbongdan Rossiya provayderi TTKga o'tdi, lekin Rossiya orqali marshrutlashni saqlab qoldi.
- 175.45.177.0/24 TTKdan foydalanishni davom ettirdi.
- 175.45.178.0/24 Cenbongdan TTKga, so'ngra yana Cenbongga qaytdi.
- 175.45.179.0/24 Cenbongdan foydalanishni davom ettirdi.
Bu kuzatishlar hodisa paytida marshrutlash o'zgarganini tasdiqlaydi, lekin bu o'zgarishlar ataylab himoya choralari bo'lganmi yoki ulanish muammolari natijasi bo'lganmi, buni aniqlamaydi.
Janubiy Koreya telekanali SBS 42 ta asosiy .kp veb-sayti 21-oktabr kuni soat 19:00 atrofida barqaror ishlashga qaytganini xabar qildi, bu taxminan 32 soatlik buzilishdan keyin sodir bo'ldi. Avvalgi xabarlarda uzilishlar uchun mumkin bo'lgan tushuntirishlar sifatida elektr energiyasi beqarorligi, telekommunikatsiya nosozliklari va texnik xizmat ko'rsatish ko'rib chiqilgan edi.
Kentikning keyingi trafik tahlili DDoS hujumi bahosini mustahkamladi, lekin hujumchilarni aniqlamadi. Kuzatilgan trafik bilan bog'liq mamlakatlar o'sha joylardagi hukumatlar yoki operatorlarni ifodalashi shart emas.
Bundan tashqari, mavjud hisobotlarda hujum kengligi, paket tezligi, transport protokollari yoki kuchaytirish texnikalari ishlatilganmi yoki yo'qmi, aniqlanmagan, bu esa bir nechta muhim texnik tafsilotlarni hal qilinmagan holda qoldiradi.
Multiple waves of DDoS attacks disrupted North Korea’s internet infrastructure this week, intermittently knocking over 40 official websites offline for about 32 hours.
Network monitoring company Kentik linked the outages to synchronized surges of inbound traffic that began on October 20, 2026.
Doug Madory, Kentik’s director of internet analysis, noted that aggregate traffic data showed heavy flows originating from Vietnam, the Philippines, Venezuela, and other countries. The traffic surge began around 02:01 UTC, when North Korean websites became inaccessible.
“This traffic all started at the same time and is coming from Vietnam and Venezuela. That’s definitely a DDoS attack,” Madory told Reuters. However, Kentik observed only a portion of the traffic directed toward North Korea, limiting visibility into the incident’s full scale.
North Korea State Websites Affected
The disruptionimpacted websites using North Korea‘s .kp country-code top-level domain, including the Ministry of Foreign Affairs, the Korean Central News Agency, Rodong Sinmun, Naenara, and the national airline Air Koryo. NK News also reported interruptions affecting the Silibank SMTP email server.
Monitoring indicated that KCNA was offline for 19 of the first 24 hours after the disruption began. Other affected websites experienced only brief windows of connectivity, suggesting repeated interruptions rather than a single continuous shutdown across all services.
In his technical analysis, Madory identified the address block 175.45.176.0/24, which contains name servers for the .kp domain, and reported repeated outages affecting that range. This meant that the domain-name infrastructure was as critical to the disruption as website availability.
Madory also documented routing changes involving North Korea’s AS131279 network during the attacks. His observations showed different behaviors across four adjacent address blocks:
- 175.45.176.0/24 switched from Cenbong to the Russian provider TTK but remained routed through Russia.
- 175.45.177.0/24 continued using TTK.
- 175.45.178.0/24 moved from Cenbong to TTK, then back to Cenbong.
- 175.45.179.0/24 continued using Cenbong.
These observations confirm that routing changed during the incident, but do not clarify whether these changes were deliberate defensive measures or the result of connectivity issues.
South Korean broadcaster SBS reported that 42 major .kp websites had returned to stable operation around 7 p.m. on October 21, following roughly 32 hours of disruption. Earlier reports had considered power instability, telecommunications faults, and maintenance as possible explanations for the outages.
Kentik’s subsequent traffic analysis reinforced the assessment of aDDoS attack but did not identify the perpetrators. The countries associated with the observed traffic should not be assumed to represent the governments or operators in those locations.
Additionally, the available reports do not specify attack bandwidth, packet rates, transport protocols, or whether amplification techniques were used, leaving several important technical details unresolved.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.