North Korea DDoS Attacks Disrupt 40+ Government Websites for 32 Hours

North Korea DDoS attacks disrupted access to more than 40 government websites during a roughly 32-hour period of intermittent internet outages beginning October 20, 2026. Network monitoring company Kentik linked the disruption to repeated waves of unusually high inbound traffic, although the attackers have not been identified.

The outages affected North Korea’s tightly controlled public internet infrastructure, including websites associated with the country’s Ministry of Foreign Affairs and Korean Central News Agency (KCNA).

Kentik’s director of internet analysis, Doug Madory, identified a sharp traffic increase beginning at approximately 02:01 UTC on October 20. The traffic originated from networks in Vietnam, the Philippines, Venezuela and other locations and coincided with major connectivity problems.

The findings, discussed in reporting published October 23, suggest a distributed denial-of-service attack rather than a single conventional website failure. However, Kentik examined only part of the traffic reaching North Korea, and its observations do not reveal who organized the operation.

The incident also involved changes in how North Korean internet address ranges were routed through neighboring network providers. Those changes provide useful evidence about the disruption but do not independently prove how network operators attempted to respond.

The outage highlights the vulnerability of public-facing internet services when important connectivity and domain-name infrastructure are affected. For broader context about politically sensitive cyber operations, see our Nation-State Cyber Warfare and APT Threats Guide.

Key Findings From the North Korea DDoS Attacks

• Incident start: Unusual inbound traffic began around 02:01 UTC on October 20, 2026.
• Estimated disruption: Approximately 32 hours of intermittent outages and brief recoveries.
• Reported affected services: More than 40 websites using North Korea’s .kp domain.
• Notable websites: Government services, including the foreign ministry and state news agency KCNA.
• Network evidence: Kentik observed multiple inbound traffic waves associated with periods of inaccessibility.
• Technical significance: Routing and connectivity issues involved address ranges serving North Korea’s public internet, including infrastructure associated with .kp domain-name resolution.
• Attribution: No attacker, government, botnet or named threat group has been publicly identified as responsible.

North Korea DDoS Attacks: What Happened on October 20?

North Korea’s public internet services began experiencing significant disruptions on Tuesday, October 20, 2026.

The outages affected websites that are ordinarily accessible from outside the country, including several government-operated platforms.

At approximately 02:01 UTC, or around 11:01 a.m. in North Korea, Kentik observed sudden increases in traffic directed toward the country’s internet infrastructure.

Researcher’s network observations: Doug Madory shared public measurements relating to North Korea’s internet disruption.

The timing closely matched the period when North Korean websites became difficult or impossible to reach.

Rather than observing only one brief traffic spike, researchers identified several waves of increased activity.

That pattern is significant because coordinated floods of network requests or packets can overwhelm a target’s available capacity and prevent legitimate users from establishing connections.

Reuters reported that the interruption continued intermittently for approximately 32 hours, with websites repeatedly going offline and returning for short periods.

South Korean reporting indicated that affected services had substantially recovered by the evening of October 21.

However, the available evidence does not establish that every service remained continuously unavailable throughout the entire 32-hour window.

Which North Korean Websites Went Offline?

Reporting identified more than 40 affected websites under North Korea’s .kp country-code top-level domain.

Among the reported services were the Ministry of Foreign Affairs and the Korean Central News Agency, also known as KCNA.

These websites are part of the country’s limited public-facing internet presence.

Unlike countries hosting large numbers of independently operated commercial websites, North Korea maintains a relatively small and tightly controlled collection of publicly accessible internet services.

As a result, disruption affecting shared connectivity or supporting infrastructure may make a substantial proportion of visible websites inaccessible at the same time.

The following figures summarize what was reported.

The evidence supports a significant availability incident. It does not prove that government accounts, internal databases or classified documents were compromised.

How Kentik Identified the DDoS Traffic Waves

Kentik’s analysis focused on network traffic patterns observed during the incident.

Doug Madory, the company’s director of internet analysis, reported that multiple inbound traffic waves coincided with the outages.

DDoS traffic evidence: The following post provides a direct reference to Doug Madory’s network analysis.

Traffic was observed from networks located in Vietnam, the Philippines, Venezuela and other countries.

These observations support a distributed denial-of-service explanation because many sources can simultaneously send traffic toward a limited set of destinations.

However, the location of a source network does not identify the person or organization responsible for the traffic.

Attackers may use compromised servers, infected devices, rented infrastructure or other intermediary systems located far from their own physical location.

Kentik also cautioned that it examined only a portion of the traffic directed toward North Korea.

Consequently, the findings should not be interpreted as a complete packet-level reconstruction of the attack.

The public analysis does not establish an independently verified peak bandwidth, total packet rate, protocol distribution or specific DDoS toolkit.

What researchers could observe was the close relationship between large traffic increases and declining service availability.

North Korea Internet Outage: Timeline of the 32-Hour Disruption

The following timeline combines the network observations described by Kentik with reporting about website availability and recovery.

This sequence describes reported observations, not a complete forensic timeline from the affected network operator.

Why North Korea’s .kp DNS Infrastructure Matters

One of the most technically important observations concerned 175.45.176.0/24, a public IPv4 network range associated with North Korean infrastructure.

Madory reported repeated outages involving the range, which includes name servers used for North Korea’s .kp country-code domain.

Domain Name System (DNS) servers translate domain names into IP addresses so applications can locate network services.

If essential name servers become unreachable, users may struggle to access multiple websites even when some underlying web servers are still operating.

However, a website failing to load does not automatically mean its DNS server was the direct DDoS target.

A domain may also become unreachable because of congestion, disrupted upstream routing, packet loss or failures elsewhere in the network path.

The public observations do not establish whether attackers specifically targeted .kp name servers or whether those systems were affected by broader connectivity problems.

Nevertheless, the presence of important DNS infrastructure within an affected address range helps explain why a relatively small number of network disruptions can have a wide visible impact.

North Korean Network Routes Changed During the Outages

In addition to traffic analysis, Madory documented routing changes involving North Korea’s internet network, AS131279.

Public internet routing relies on the Border Gateway Protocol (BGP), which allows networks to announce the routes used to reach their IP addresses.

During the incident, researchers observed changes involving different address ranges and upstream transit providers.

Additional network observations: Doug Madory also published further findings related to the disruption.

The reported providers included Cenbong and Russian telecommunications network TTK, also known as Transtelecom.

These differences show that the country’s publicly visible routes did not all change in the same way.

Routing modifications can occur for numerous reasons, including network operations, failure recovery and traffic engineering.

In this case, the observations are consistent with a network experiencing disruption, but the public data do not confirm whether the changes were deliberately implemented as DDoS mitigation.

It would also be incorrect to assume that the use of a provider in Russia identifies Russia as either an attacker or a participant in the operation.

How a DDoS Attack Can Disrupt Government Websites

A distributed denial-of-service attack aims to make a network or online service unavailable by overwhelming its capacity or processing resources.

Different DDoS techniques can affect different layers of a service.

Network Capacity Exhaustion

Large volumes of inbound traffic can consume an internet connection’s available bandwidth.

If legitimate requests cannot pass through congested infrastructure, websites and other services may become unreachable.

Infrastructure Resource Exhaustion

Some attacks target routers, firewalls, load balancers or other systems that process network traffic.

Those systems may experience excessive connection state, processing pressure or resource consumption.

Application-Layer Requests

Other attacks generate large numbers of requests to websites or application endpoints.

Even comparatively modest traffic can disrupt an application when the targeted operation is expensive to process.

DNS Availability Problems

Attacks targeting DNS infrastructure can affect several services simultaneously because users may be unable to resolve domain names.

It is important to distinguish these general DDoS methods from what has been specifically established in North Korea’s October incident.

Kentik identified repeated traffic surges, but the available reporting does not provide enough packet-level evidence to confirm which DDoS technique or combination of techniques was used.

Did Traffic From Vietnam, the Philippines and Venezuela Identify the Attackers?

No. Observed traffic origin is not the same as attacker attribution.

Kentik’s observations identified network traffic associated with several countries, including Vietnam, the Philippines and Venezuela.

That information helps analysts understand the geographic distribution of visible traffic sources.

It does not establish that the governments, businesses or residents of those countries organized the attacks.

Distributed attacks frequently involve infrastructure controlled through compromised devices or other remote systems.

Additionally, researchers have not publicly identified a specific botnet, malware family or threat group responsible for this disruption.

Claims that a particular government ordered the attack would require separate corroborating evidence.

Attribution remains unknown as of the reporting reviewed on October 24, 2026.

Was the North Korea Outage Caused by Electricity Problems?

Early reporting considered possible power instability and telecommunications faults as explanations for the widespread website failures.

Those possibilities reflected uncertainty before detailed traffic observations were reported.

Kentik’s subsequent analysis provided stronger evidence of an intentional traffic-flooding event.

The close timing between repeated inbound traffic surges and website unavailability supports a DDoS explanation.

However, the network monitoring company did not provide a complete account of every affected system or underlying physical infrastructure component.

It is therefore more precise to describe DDoS as the explanation supported by network analysis rather than claim that every alternative technical cause has been independently disproven.

Reuters also reported that the incident appeared unrelated to wider internet disruption associated with PHP-related vulnerability disclosures later in the week.

Why This Outage Matters for Internet Infrastructure Security

The North Korea internet outage illustrates the importance of understanding dependencies across web hosting, domain-name services and international routing.

An organization may operate numerous websites, but those websites can depend on a smaller number of shared network connections and DNS services.

When a critical dependency becomes unreachable, multiple sites may fail together.

This creates a visible effect that can resemble many unrelated application outages, even when the underlying problem affects only a limited number of infrastructure components.

The incident also shows why website availability testing alone may not identify an outage’s cause.

External monitoring may detect failures, but network-flow analysis, routing observations and upstream-provider data are often needed to distinguish traffic flooding from ordinary system faults.

A similar operational lesson applies to other infrastructure outages. In a separate incident, our Ubuntu and Canonical DDoS coverage examines disruption affecting public-facing technology services.

The incidents are separate and should not be treated as evidence of a shared attacker or campaign.

What Network Security Teams Can Learn From the Incident

Although the affected infrastructure belongs to North Korea, the general resilience lessons are relevant to operators of public websites and networks worldwide.

1. Monitor Traffic and Availability Together

Combine website uptime checks with network traffic monitoring.

A simultaneous rise in inbound traffic and decline in availability may provide important evidence of a DDoS event.

2. Track DNS Dependencies

Identify the authoritative name servers responsible for critical domains.

Assess whether DNS resilience and supported redundancy measures are sufficient for the organization’s risk profile.

3. Maintain Visibility Into BGP Routing

Unexpected route changes may indicate operational disruptions or deliberate traffic engineering.

Review routing telemetry alongside provider status and network performance rather than treating every route change as malicious.

4. Coordinate With Transit Providers

Internet service providers and upstream networks can play an important role in traffic filtering and resilience planning.

Organizations should have documented escalation contacts and response procedures before an incident occurs.

5. Avoid Premature Attribution

Traffic associated with foreign networks does not automatically reveal the attack organizer.

Investigators should avoid equating geographic traffic origin with state sponsorship.

6. Document Recovery Evidence

Maintain timelines of network availability, route changes, traffic surges and mitigation actions.

This helps distinguish observed facts from explanations developed after the incident.

Confirmed vs Unknown: North Korea’s October DDoS Incident

Supported by Network Observations and Reporting

• North Korean public internet services experienced significant outages beginning October 20.
• More than 40 .kp government-related websites were reportedly affected.
• The disruption involved approximately 32 hours of intermittent connectivity problems.
• Kentik observed repeated inbound traffic waves coinciding with the outages.
• Traffic was observed from networks in Vietnam, the Philippines, Venezuela and other locations.
• An affected address range included infrastructure used by North Korea’s .kp domain-name system.
• Public routing observations showed changes involving Cenbong and TTK.
• The traffic evidence strongly supports a DDoS explanation.

Not Established by the Available Evidence

• The identity of the individual or organization responsible.
• Government sponsorship of the traffic floods.
• A confirmed malware family or botnet.
• The precise DDoS protocols or amplification techniques used.
• Peak attack bandwidth or packet rate.
• That .kp DNS servers were directly targeted rather than indirectly affected.
• That the routing changes were definitely deliberate mitigation actions.
• That government databases or internal systems were breached.
• That every North Korean internet service was continuously offline for the full 32 hours.

CyberUpdates365 Analysis

The October 2026 North Korea outage provides an important example of how internet infrastructure can become a critical point of failure during large-scale traffic disruption.

The strongest technical evidence is the close alignment between repeated inbound traffic spikes and loss of website availability.

That relationship makes the DDoS explanation more convincing than a theory based only on unverified claims or website error reports.

However, the available public measurements cover only part of the country’s inbound traffic.

As a result, researchers cannot use those observations alone to establish the full attack volume or reconstruct every technical stage.

The affected .kp infrastructure is another notable aspect.

When authoritative DNS services or important upstream connectivity paths become unavailable, the impact can extend across multiple domains and applications.

The reported disruption to more than 40 government-related websites illustrates how shared infrastructure may concentrate availability risk.

The documented BGP changes add useful operational context but also demonstrate the limits of public measurement.

Routing changes can indicate efforts to maintain connectivity, respond to failure or manage traffic. Without confirmation from the operators, the motivation behind each change remains uncertain.

Perhaps the most important reporting distinction concerns attribution.

North Korea is frequently discussed in connection with cyber espionage and financially motivated hacking operations.

But in this incident, North Korea was the reported target of disruptive network traffic.

The existence of traffic from countries such as Vietnam and Venezuela does not establish responsibility by any government or identifiable threat actor.

Cybersecurity analysis should avoid replacing unknown attacker identity with speculation based on political relationships or the geographic locations visible in network telemetry.

For security teams, the incident reinforces the need to combine independent connectivity monitoring, authoritative DNS visibility, routing intelligence and upstream-provider coordination.

The central lesson is that network-wide outages require evidence-based analysis of traffic, DNS and routing conditions, while attribution should remain unresolved until independent evidence identifies the operator.

Research Evidence

• Incident: North Korea public internet disruption.
• Start: October 20, 2026, around 02:01 UTC.
• Duration: Approximately 32 hours of intermittent outages.
• Reported affected websites: More than 40 under the .kp domain.
• Notable services: Ministry of Foreign Affairs and KCNA websites.
• Network monitoring organization: Kentik.
• Researcher: Doug Madory, director of internet analysis.
• Observed traffic locations: Vietnam, the Philippines, Venezuela and others.
• Relevant affected network: 175.45.176.0/24.
• Relevant autonomous system: AS131279.
• Reported routing providers: Cenbong and TTK.
• Likely technical cause: Repeated distributed denial-of-service traffic waves.
• Attack volume: Not publicly established in the reviewed evidence.
• Botnet identification: Not confirmed.
• Attacker attribution: Unknown.

Frequently Asked Questions

What happened during the North Korea DDoS attacks?

North Korean public websites experienced repeated outages beginning October 20, 2026. Kentik observed several waves of inbound traffic that coincided with the disruption, supporting a DDoS explanation.

How many North Korean websites were affected?

Reports indicated that more than 40 websites under the country’s .kp domain were affected, including the foreign ministry and KCNA.

How long did the North Korea internet outage last?

The reported disruption lasted approximately 32 hours, although the websites experienced intermittent failures and temporary recoveries rather than necessarily remaining continuously offline.

Who was responsible for the DDoS attacks?

The responsible party has not been identified. Observed traffic from particular countries does not establish who organized the attacks.

What did Kentik discover?

Kentik identified repeated traffic surges beginning around 02:01 UTC on October 20 and linked their timing to the loss of website availability.

Was North Korea’s DNS infrastructure affected?

Researchers observed disruption involving an address range associated with .kp name servers. However, the public evidence does not establish whether DNS servers were directly targeted.

Did the attack involve a known botnet or CVE?

No specific botnet, exploited CVE or attack toolkit has been publicly confirmed in the reviewed reporting.

Were North Korean government databases hacked?

The available reporting concerns service availability. It does not establish unauthorized access to government databases or theft of internal information.

Final Takeaway

Multiple waves of suspected DDoS traffic disrupted North Korea’s public internet infrastructure beginning October 20, 2026.

More than 40 government-related websites were reportedly affected over an approximately 32-hour period, with Kentik identifying repeated traffic surges that coincided with outages.

Network routing changes and disruption affecting infrastructure associated with .kp domain-name resolution add important technical context.

However, the public evidence does not identify the attackers, prove state sponsorship or establish a particular botnet or attack technique.

For network defenders, the incident demonstrates why traffic monitoring, DNS resilience and routing visibility are critical to diagnosing and responding to major internet availability failures.

How do DDoS attacks disrupt real-world services?

Our related coverage examines another incident involving downtime at public-facing technology infrastructure and the broader availability risks faced by service operators.

Read: Ubuntu and Canonical DDoS Attack Disrupts Public Services →

Official Sources and Research

• Reuters — Kentik Analysis of North Korea Internet Outage, October 23, 2026
• NetBlocks — Independent Internet Connectivity Monitoring
• Cybersecurity News — Network Routing and Traffic Analysis