VulnHub

Norwegian government services faced significant disruptions due to a coordinated Distributed Denial of Service (DDoS) attack. The attack overwhelmed the network infrastructure, affecting various online services that citizens rely on for accessing government resources. While specific agencies impacted have not been detailed, the scale of the attack suggests a serious attempt to disrupt operations. These types of attacks can hinder public services and erode trust in government capabilities. Authorities are likely working to restore normal operations and investigate the source of the attack to prevent future incidents.

Norway's shared government digital infrastructure faced its third distributed denial-of-service (DDoS) attack on August 24, 2023, starting at 03:38 CEST. This attack disrupted various online services that citizens, businesses, and public agencies rely on. Fortunately, officials reported no indications of data breaches or compromise during the incident. The repeated nature of these attacks raises concerns about the resilience of Norway's digital systems and their ability to withstand ongoing cyber threats. This incident highlights the need for stronger cybersecurity measures to protect essential public services.

Norway's government digital services have been disrupted by a significant distributed denial-of-service (DDoS) attack that began on Monday. The attack has targeted the country's shared digital infrastructure, impacting various services utilized by public sector entities. As a result, users may experience difficulties accessing important government resources and services. This incident raises concerns about the security and reliability of government digital platforms, particularly in the face of increasing cyber threats. Authorities are working to mitigate the effects of the attack and restore normal operations as soon as possible.

Threema, an encrypted messaging service, has been facing significant Distributed Denial of Service (DDoS) attacks since Tuesday evening, which have continued into Wednesday. These attacks not only targeted Threema's operations but also affected its Swiss colocation partner, Nine. DDoS attacks can overwhelm a service with excessive traffic, leading to disruptions and downtime, which is especially concerning for a communication platform that emphasizes privacy and security. Users of Threema may experience difficulties accessing the service during this time, raising concerns about the reliability of encrypted messaging solutions under attack. The situation underscores the ongoing challenges that secure communication platforms face in maintaining service availability amidst cyber threats.

The Evooo1Bot is a new Linux botnet that significantly enhances the capabilities of the existing Mirai botnet. Researchers found that Evooo1Bot is not just focused on launching DDoS attacks; it also includes modules for exploiting vulnerabilities, stealing credentials, and creating reverse SOCKS relays. This means that compromised devices can be used for more than just overwhelming targets with traffic; they can serve as a persistent infrastructure for attackers. The expansion of these capabilities poses a serious risk to users and organizations, as it increases the potential for data theft and ongoing exploitation. Security professionals need to be vigilant about the devices on their networks to prevent becoming part of this botnet.

Researchers have discovered a new Linux botnet called Evooo1Bot, which builds upon the Mirai botnet's source code. This botnet can exploit known vulnerabilities to convert internet-facing devices into SOCKS5 proxies. The malware not only incorporates the DDoS capabilities of Mirai but also adds several new features that enhance its functionality. This poses a significant risk as it can affect various edge devices that are often less secure and can be used for malicious activities like distributed denial-of-service attacks. Users and companies with exposed devices need to take immediate action to protect their systems from this emerging threat.

Threema, a secure messaging service from Switzerland, experienced significant outages due to large-scale DDoS attacks. These attacks disrupted communication for many users, but organizations using Threema On-Prem were not impacted because their deployments operate on their own infrastructure. The incidents raise concerns about the reliability of online communication services, especially for users who depend on secure messaging for sensitive conversations. As DDoS attacks become more common, companies need to consider additional protective measures to safeguard their services from similar disruptions in the future.

Threema, a secure messaging platform, experienced significant disruptions earlier this week due to multiple distributed denial-of-service (DDoS) attacks. These attacks overwhelmed Threema's servers, causing service outages and making it difficult for users to send messages. While the company worked to restore normal operations, the incident raised concerns about the security of communication platforms and the potential for similar attacks in the future. Such disruptions can affect users' ability to securely communicate, particularly in sensitive situations where privacy is paramount. This event serves as a reminder of the vulnerabilities that even well-regarded secure services can face from malicious actors.

A new botnet named Evooo1Bot has emerged, targeting internet-facing routers and other gateway devices. Based on the Mirai malware, this botnet converts these devices into SOCKS5 traffic relay nodes, allowing attackers to route internet traffic through them. This can enable various types of malicious activities, including distributed denial-of-service (DDoS) attacks. The attack affects any vulnerable Linux-based routers or similar devices that are exposed to the internet, making it crucial for users and network administrators to secure their devices against unauthorized access. As the botnet continues to spread, it poses a significant risk to network integrity and privacy.

DDoS attacks have surged in scale during the first half of 2026, according to Cloudflare's latest report. Attackers are employing multi-vector techniques, leading to massive traffic floods that can exceed 1 terabit per second. These hyper-volumetric campaigns are impacting various online services across multiple industries, causing disruptions that can cripple businesses and services. The report notes that these attacks are not only larger but also shorter in duration, suggesting a shift towards more automated and efficient methods of conducting these attacks. As organizations increasingly rely on online services, the growing frequency and intensity of DDoS attacks present a significant challenge to cybersecurity.

Researchers from Palo Alto Networks Unit 42 have identified a new version of the Kimwolf botnet, known as Kimwolf v7, which targets Android devices and Internet of Things (IoT) devices. This upgraded botnet enhances its ability to launch distributed denial-of-service (DDoS) attacks by disguising its HTTP/2 traffic to resemble legitimate web browsing. This makes it harder for security systems to detect and mitigate the attacks. The discovery of Kimwolf v7 raises concerns for users of vulnerable Android and IoT devices, as attackers can exploit these weaknesses to disrupt services and potentially gain unauthorized access to sensitive information. Companies and users need to be vigilant and ensure their devices are secured against such threats.

In the second quarter of this year, Cloudflare reported a significant increase in large-scale distributed denial-of-service (DDoS) attacks, mitigating over 800 incidents that exceeded 1 terabit per second (Tbps). This marks a fivefold surge compared to the previous quarter, indicating a growing trend in the severity of DDoS attacks. These attacks primarily target online services and can disrupt normal operations, affecting businesses and their customers. The rise in attack volume is concerning, as it suggests that attackers are increasingly capable of leveraging powerful botnets to overwhelm networks. Companies need to be vigilant and consider bolstering their defenses against such high-capacity attacks to maintain service availability.

Researchers from Cisco Talos have discovered that hackers are exploiting simple authorization claims to circumvent security measures in artificial intelligence systems. This vulnerability allows them to create tools for Distributed Denial of Service (DDoS) attacks, steal user credentials, and gain access to live camera feeds. The implications are significant, as it poses a risk to various platforms that utilize AI to manage security protocols. Companies that rely on AI for protection need to be vigilant and assess their defenses to prevent unauthorized access and potential data breaches. This incident serves as a reminder of the evolving tactics used by cybercriminals to exploit weaknesses in technology.