Loading story…
Bluesky said a day-long outage affecting its social network was caused by a distributed denial-of-service (DDoS) attack that flooded the platform with junk traffic for roughly 24 hours. Users in the United States, United Kingdom, France, and other countries reported access problems, and the disruption affected both Bluesky’s website and mobile app, leaving the decentralized service inaccessible for part of the incident.
Bluesky said it has strengthened its defenses and is continuing to monitor the situation, but did not disclose technical details about the traffic or its origin. Security researchers cited posts on the IFIN public forum in which the Islamic Cyber Resistance in Iraq-313 Team, described as an Iran-backed actor, claimed responsibility; however, public attribution remains unconfirmed. The outage follows another major DDoS-related disruption that hit Bluesky earlier in the year, and researchers also linked the same group to claimed attacks on GitHub, Spotify, and Ubuntu.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Bluesky officially said the day-long service disruption was caused by a distributed denial-of-service attack that flooded the platform with junk traffic over the previous 24 hours. The company publicly confirmed the attack in a Monday post.
Users in the United States, the United Kingdom, France, and other countries began reporting access issues affecting Bluesky's website and mobile application. The disruption was later described as part of a roughly 24-hour DDoS attack.
Following the outage, Bluesky said it strengthened or upgraded its defenses and continued monitoring the situation. The company did not disclose further technical details about the malicious traffic or infrastructure involved.
Security researchers on the public IFIN forum reported that the Islamic Cyber Resistance in Iraq-313 Team claimed responsibility for the Bluesky attack. The group was described as Iran-backed, though attribution remained unconfirmed by Bluesky.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bluesky suffered a sustained **distributed denial-of-service (DDoS) attack** that caused intermittent outages and degraded performance across its website and mobile app for more than a day. The disruption began early Thursday and produced slow loading, blank screens, missing content, and repeated **"Rate Limit Exceeded"** errors, with users reporting problems accessing feeds, notifications, threads, search, user profiles, and popular areas such as Discover. Company officials said the platform was being hit hard by coordinated traffic and was actively mitigating the attack, which also affected key API servers and even parts of Bluesky’s status infrastructure. Bluesky said it had found **no evidence of unauthorized access to private user data**, while reports indicated the impact was concentrated on Bluesky-operated services and that other communities running their own infrastructure on the underlying decentralized protocol remained available.
Jun 29, 2026
Mastodon said its primary server, **`mastodon.social`**, was hit by a significant distributed denial-of-service (**DDoS**) attack that caused intermittent outages and left the instance temporarily unusable for some users. The company said it began investigating early Monday morning and later deployed countermeasures that restored access, while warning that some instability could continue because the attack was still ongoing. The disruption affected Mastodon’s flagship instance rather than the broader federated network, underscoring how decentralized social platforms can suffer localized availability failures without a platform-wide compromise. Reports noted that the incident followed a similar prolonged DDoS campaign targeting **Bluesky**, and emphasized that DDoS activity is intended to overwhelm services with junk traffic and degrade availability, not inherently to steal data.
Jun 29, 2026
Canonical confirmed widespread disruption across Ubuntu and Canonical web infrastructure after a sustained distributed denial-of-service attack hit `ubuntu.com` and related services. The pro-Iran hacktivist group **The Islamic Cyber Resistance in Iraq (313 Team)** claimed responsibility on Telegram, describing the operation as a multi-hour campaign, while reports said the impact lasted more than 12 hours. Canonical acknowledged the outages on its status page and through Ubuntu social channels as teams worked to restore availability. The incident affected core services including website access, Canonical account logins, developer portals, package and security endpoints such as `archive.ubuntu.com`, `security.ubuntu.com`, and Ubuntu Security API resources for CVEs and notices. The disruption interfered with Ubuntu downloads, package installation, system updates, vulnerability-data retrieval, and automated patching workflows used by administrators worldwide. A follow-up message from the group introduced an apparent extortion angle, warning Canonical to make contact or face continued attacks, although no motive for targeting the company was publicly stated.
Jun 29, 2026