Loading story…
Mastodon said its primary server, mastodon.social, was hit by a significant distributed denial-of-service (DDoS) attack that caused intermittent outages and left the instance temporarily unusable for some users. The company said it began investigating early Monday morning and later deployed countermeasures that restored access, while warning that some instability could continue because the attack was still ongoing.
The disruption affected Mastodon’s flagship instance rather than the broader federated network, underscoring how decentralized social platforms can suffer localized availability failures without a platform-wide compromise. Reports noted that the incident followed a similar prolonged DDoS campaign targeting Bluesky, and emphasized that DDoS activity is intended to overwhelm services with junk traffic and degrade availability, not inherently to steal data.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
By 9:05 a.m. ET, Mastodon said it had implemented countermeasures that restored access to mastodon.social, though some instability remained because the attack was still ongoing.
Around 7:00 a.m. ET, Mastodon confirmed it was investigating the attack affecting mastodon.social as the disruption continued.
Mastodon said mastodon.social was hit by a significant distributed denial-of-service attack early Monday morning, causing intermittent outages and making the server partially unavailable.
A Bluesky account shared the Breakglass report on Kimsuky, highlighting the mapped phishing infrastructure and linking it to DPRK cyber activity.
Breakglass Intelligence published a report mapping a DPRK-linked Kimsuky credential-harvesting operation, describing 850 hostnames, 6 servers, and a single kill chain targeting Korean credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcebsky.app
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bluesky suffered a sustained **distributed denial-of-service (DDoS) attack** that caused intermittent outages and degraded performance across its website and mobile app for more than a day. The disruption began early Thursday and produced slow loading, blank screens, missing content, and repeated **"Rate Limit Exceeded"** errors, with users reporting problems accessing feeds, notifications, threads, search, user profiles, and popular areas such as Discover. Company officials said the platform was being hit hard by coordinated traffic and was actively mitigating the attack, which also affected key API servers and even parts of Bluesky’s status infrastructure. Bluesky said it had found **no evidence of unauthorized access to private user data**, while reports indicated the impact was concentrated on Bluesky-operated services and that other communities running their own infrastructure on the underlying decentralized protocol remained available.
Jun 29, 2026
Bluesky said a day-long outage affecting its social network was caused by a distributed denial-of-service (**DDoS**) attack that flooded the platform with junk traffic for roughly 24 hours. Users in the United States, United Kingdom, France, and other countries reported access problems, and the disruption affected both Bluesky’s website and mobile app, leaving the decentralized service inaccessible for part of the incident. Bluesky said it has strengthened its defenses and is continuing to monitor the situation, but did not disclose technical details about the traffic or its origin. Security researchers cited posts on the IFIN public forum in which the **Islamic Cyber Resistance in Iraq-313 Team**, described as an Iran-backed actor, claimed responsibility; however, public attribution remains unconfirmed. The outage follows another major DDoS-related disruption that hit Bluesky earlier in the year, and researchers also linked the same group to claimed attacks on GitHub, Spotify, and Ubuntu.
Aug 20, 2026
4chan has repeatedly been hit by major cyberattacks, including a large-scale **distributed denial-of-service** campaign that knocked the site offline or made it intermittently unreachable for nearly a day amid fallout from Anonymous-linked pro-WikiLeaks operations. Reporting at the time said the outage resembled attacks that had recently struck **Mastercard, Visa, and PayPal**, and Netcraft confirmed the disruption was severe before partial recovery began. Separate reporting on broader internet outages and high-profile DDoS incidents, including the record attack on **KrebsOnSecurity** and claims by WikiLeaks that its supporters were involved in a massive attack, underscored the wider hacktivist and botnet-driven environment surrounding such disruptions. In a later and more damaging incident, 4chan said it was forced into a nearly two-week shutdown after a **catastrophic database attack** that compromised source code, multiple databases, and a critical server, while also exposing personal information tied to moderators and many users. The site said attackers vandalized systems and that recovery was slowed by aging code, weak infrastructure, limited funding, and a shortage of skilled staff. When service returned, core functions remained restricted, with posting and image uploads still unavailable, the `/f/` board permanently removed because of `.swf`-related exploit risk, and PDF uploads temporarily disabled as administrators rebuilt the platform.
Jun 29, 2026