Large-scale DDoS Attacks Disrupted Threema Secure Messaging Service
Large-scale DDoS Attacks Disrupted Threema Secure Messaging Service
Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service earlier this week, causing severe disruptions to communications. In a post-mortem report on Friday, the end-to-end encrypted instant messaging service stated that the attacks were difficult to defend against due to the constantly changing patterns of the threat actor. Threema explained that the attacks rendered its service “temporarily unavailable or only partially available on Tuesday evening and Wednesday morning.” 🚨
On Tuesday around 6 PM UTC, users began reporting service interruptions. The company responded about an hour later, indicating that the cause was “a network outage on our colocation partner’s side.” One user expressed frustration, stating, “Now Threema network status says ‘Connecting’ instead of ‘Connected,’ and after 10 minutes, it’s back to ‘Connected,’ yet messages are still very much delayed.” The following day, users in Switzerland, India, and China continued to report service outages, despite Threema’s status page showing no issues. However, the company confirmed it was being targeted by a series of DDoS attacks and warned users that intermittent outages were likely to occur. ⚠️
Defending against these attacks proved challenging as they persisted for an extended period, with the threat actor continually changing tactics to circumvent mitigation measures. Threema noted, “It is not entirely clear whether Threema was the primary target or if the attacks were directed at multiple targets.” An unrelated technical issue also prevented the company from updating its current system status page, leading to its temporary removal until the problem was resolved. Organizations using Threema On-Prem did not experience any issues since they rely on their own infrastructure. 🔒
Business customers using Threema Work were informed via email on Wednesday morning about the unstable service conditions, and account managers provided updates in response to inquiries. To prevent similar incidents in the future, the Swiss company has implemented “specialized DDoS protection as an additional measure” to filter attack traffic upstream and reduce the load on its infrastructure. 💪