The North Korea DDoS outage knocked more than 40 of the country’s official state websites offline for about 32 hours from Tuesday 20 October 2026, including the foreign ministry and the state news agency KCNA. The DDoS attribution comes from analysis by US network monitoring company Kentik, reported by Reuters, and it carries a caveat Reuters states plainly: a cyberattack “likely caused” the outages. No attacker has been identified, and no North Korean official confirmation appears in the sources reporting the incident.
What went offline in the North Korea DDoS outage
More than 40 official sites using North Korea’s .kp domain were inaccessible or unstable on Tuesday 20 October, according to South Korea’s Yonhap News Agency, as reported by Reuters on 21 October. The foreign ministry and KCNA were among them. Reuters reported on 23 October that North Korea’s internet experienced multiple waves of traffic from places such as Vietnam and the Philippines at the same time as the outages began. Kentik’s director of internet analysis, Doug Madory, used a different second country in his own quoted words: “This traffic all started at the same time and it is coming from Vietnam and Venezuela. That’s definitely a DDoS (Distributed Denial-of-Service) attack.” Both wordings appear in Reuters’ report: the Philippines in its narrative paraphrase, Venezuela in Madory’s quote.
The disruption also touched the machinery underneath the websites. Madory’s observations identified repeated downtime affecting 175.45.176.0/24, a network block containing name servers for .kp domains, which translate website names into internet addresses. Route observations described that block moving from Cenbong (AS134544) to Russia’s Transtelecom/TTK (AS20485), and a second block, 175.45.178.0/24, switching to TTK before returning to Cenbong. Whether those route changes were deliberate mitigation is not established.
Read also: our coverage of the DOJ’s North Korea laptop-farm case, a different story that is unrelated to this outage: North Korean Laptop Farm Busted: DOJ Says 70+ US Companies Infiltrated.
The timeline, reconstructed
The reported times, put in order, show an outage that came in waves rather than one clean break:
- 02:01 UTC, Tuesday 20 October 2026: Kentik’s traffic spikes begin.
- 18:10 to 23:50 GMT, Tuesday 20 October 2026: Telecom Observer detects nearly six hours of disruption in North Korea’s Border Gateway Protocol (BGP) routing infrastructure.
- By 00:43 GMT, Wednesday 21 October 2026: KCNA and newspaper Rodong Sinmun are accessible again, per Reuters on 21 October, amid continuing intermittent outages.
- Around 7 p.m. local time, Wednesday 21 October 2026: South Korean reporting, via Cyber Security News, puts services returning after repeated downtime and brief recoveries.
As our analysis, two calculations sharpen that picture. First, the BGP disruption window lasted 5 hours 40 minutes, which is about 18 percent of the roughly 32-hour unstable period (5.67 divided by 32 is 17.7 percent). So the documented routing-level disruption covered less than one-fifth of the total window; the rest was intermittent site-level unreachability, not continuous BGP loss. Second, adding 32 hours to the 02:01 UTC start on 20 October gives about 10:01 UTC on 21 October, the middle of the reported recovery day, which fits the pattern of brief recoveries followed by further downtime before the evening local-time return.
What is still unconfirmed
The biggest unknown is who did it. Kentik’s data does not indicate who the perpetrators are, and Kentik only analysed a portion of the traffic directed at North Korea. Traffic source countries do not identify who ordered the attacks, and no specific botnet has been publicly linked to the incident. The attack method, peak traffic volume, and tools used have not been reported. No figure for the number of people affected appears in any source checked, so this article gives none. And this was a DDoS availability outage, not a data breach: no data theft, passwords, or personal data loss has been reported, and nothing here should be read as implying any.
Two early explanations did not survive the week. Early coverage considered power problems or telecommunications faults as possible causes, and South Korean media had cited security experts as saying unstable power supplies could have been a cause. Reuters also notes the outage appeared unrelated to global internet issues stemming from the disclosure of vulnerabilities in the PHP programming language later in the week. There is also a precedent, cited by Reuters: in late 2014, following controversies over a Sony Pictures comedy about a fictional assassination of North Korean leader Kim Jong Un, North Korea experienced an hours-long complete internet outage. The 2026 event differs in shape: intermittent outages over about 32 hours hitting 40-plus named state sites, rather than a single continuous blackout, and sources do not describe it as a complete national internet shutdown.
What to watch next
Four questions will decide whether this story grows or closes. Whether any attribution firm names a perpetrator or a botnet behind the traffic. Whether North Korea itself comments on the outage at all. Whether further waves hit .kp sites in the coming days. And whether the observed route shifts are confirmed as deliberate mitigation by operators or simply as a side-effect of the attack. Until one of those lands, the honest summary stays where Reuters left it: a cyberattack likely caused it, and the evidence for that is Kentik’s analysis, not a confession or a government statement.
Sources
- Reuters, 23 October 2026 (DDoS attribution, Kentik analysis): reuters.com
- Reuters, 21 October 2026 (initial outage, Yonhap count, Telecom Observer window): reuters.com
- Cyber Security News, 23 October 2026: cybersecuritynews.com
