More than 40 North Korean government websites, including the Ministry of Foreign Affairs and the state news agency KCNA, went dark this week in what internet-traffic analysts say was a sustained distributed denial-of-service (DDoS) campaign rather than a routine technical fault.

Traffic Floods Began Early October 20

Doug Madory, director of internet analysis at network intelligence firm Kentik, traced the outage to sudden traffic floods that began at 02:01 UTC on October 20. The incoming traffic reportedly originated from a mix of countries including Vietnam, the Philippines, and Venezuela — a geographic spread typical of botnet-driven attacks, where compromised devices scattered across the globe are instructed to flood a single target simultaneously.

Rather than one continuous surge, Kentik’s aggregate data showed several distinct waves of incoming traffic hitting North Korea’s .kp domain infrastructure. That pattern of repeated spikes, rather than a single sustained flood, is what led analysts to conclude this was a deliberate DDoS attack rather than, say, a single hardware failure or isolated network fault.

“This traffic all started at the same time, and it is coming from Vietnam and Venezuela. That’s definitely a DDoS attack,” Madory told Reuters, according to reporting carried by AsiaOne. Kentik has been careful to note that its visibility only covers a portion of the total traffic directed at North Korean networks, meaning the true scale of the assault may be larger than what the firm could directly observe.

A Day and a Half of Instability

Access to North Korean sites remained unstable for roughly 32 hours, with South Korean media reporting that services did not return to normal until around 7 p.m. local time on October 21 — and only after repeated bouts of downtime and brief, partial recoveries in between.

Part of what made the outage so disruptive was its target: the 175.45.176.0/24 network block, which hosts name servers responsible for resolving .kp domain names. When those domain name system servers go down, the effect ripples outward — visitors can’t reach any site relying on that resolution infrastructure, even if the underlying web servers hosting the actual content remain fully operational. That single point of failure likely explains why dozens of unrelated government sites appeared to fail simultaneously.

Madory’s technical observations also documented changes in how traffic was being routed during the incident. The 175.45.176.0/24 block reportedly shifted from transit provider Cenbong (AS134544) to Russia’s Transtelecom (AS20485) at one point, while a neighboring block, 175.45.178.0/24, briefly moved to Transtelecom before reverting back to Cenbong. Two other related network blocks kept their original providers throughout. It’s unclear whether these routing changes were a deliberate defensive measure by North Korean network operators attempting to absorb or reroute around the attack traffic, or simply a side effect of the underlying instability.

Attribution Remains Unknown

Despite the detailed traffic analysis, nobody has publicly claimed responsibility, and Kentik has not identified the party or parties behind the campaign. The countries from which the flood traffic originated — Vietnam, the Philippines, Venezuela, and others — are almost certainly not the true source; DDoS attacks routinely bounce off compromised routers, cameras, and other poorly secured internet-connected devices scattered across many countries, deliberately obscuring the operator’s actual location and identity. No specific botnet has been publicly tied to this particular incident.

Earlier theories floated in initial coverage of the outage pointed to possible power grid issues or routine telecommunications faults inside North Korea, a country whose internet infrastructure is notoriously opaque and prone to outages of various kinds. Kentik’s traffic data has since added more concrete evidence pointing toward a deliberate denial-of-service explanation, though it does not by itself rule out contributing technical issues on the North Korean side.

An Investigation Still Missing Key Details

What remains unknown is just as notable as what has been confirmed. Public reporting so far has not established the specific attack methodology used, the peak volume of malicious traffic generated, or the tools and infrastructure behind the campaign. Security researchers studying unrelated botnet operations — such as the previously documented Dysphoria botnet, built from compromised home routers and IP cameras — have shown how such armies of hijacked consumer devices can be marshaled to generate coordinated, multi-wave traffic floods of exactly the kind observed here.

For now, the strongest evidence tying this week’s outage to a deliberate attack is the tight correlation between the timing of incoming traffic spikes and the timing of website failures. The incident serves as a reminder that diagnosing an internet outage properly requires actual traffic measurements, not just observing that a website has gone down — while the identity of whoever ordered the attack, and its ultimate scale, remain open questions.