Multiple waves of traffic this week knocked large parts of North Korea’s public internet offline, leaving more than 40 .kp websites intermittently unreachable for roughly 32 hours. The outages began in the early hours of October 20 (02:01 UTC) and affected core services including the Ministry of Foreign Affairs and the Korean Central News Agency. Internet measurement firm Kentik, through its internet analysis director Doug Madory, traced sudden traffic floods from countries such as Vietnam, the Philippines and Venezuela, and concluded the timing and pattern pointed to distributed denial-of-service (DDoS) activity rather than routine network faults.
What the measurements show
Kentik observed several distinct waves of incoming traffic rather than a single continuous surge. Those repeated spikes coincided tightly with the periods when .kp-hosted sites were unreachable, which is a classic signal of a DDoS attack overwhelming infrastructure. The traffic records Kentik reviewed showed sources in multiple foreign countries, but those geolocations reflect where traffic entered the internet, not necessarily who orchestrated the attack. Compromised devices and hijacked routes can make attribution difficult from vantage-point data alone.
Routing and infrastructure clues
The outage disproportionately impacted name servers within the 175.45.176.0/24 block — a set of IP addresses that provide DNS translation for many .kp domains. Madory’s route analysis also noted temporary changes to how North Korean network blocks were transited: portions of 175.45.176.0/24 were observed moving from Cenbong (AS134544) to Russia’s Transtelecom (AS20485), while 175.45.178.0/24 briefly shifted to Transtelecom before returning to Cenbong. Observations included North Korea’s AS131279 and other blocks showing path changes during the incident. These path shifts explain how multiple sites could become unreachable if name resolution or BGP routes were impacted, but they do not by themselves prove deliberate rerouting was used as a mitigation tactic.
Why attribution remains unresolved
Kentik’s analysis stopped short of naming an attacker or identifying a specific botnet. The traffic patterns support a DDoS explanation, but the data do not reveal the tools, peak volume, or the operator behind the operation. While reporting on botnets such as Dysphoria highlights how compromised routers, cameras, and other IoT gear can generate coordinated floods, no public link has been established between such botnets and this event. That gap underscores a perennial problem in incident response: telemetry can confirm what happened, but not always who ordered it.
Implications for resilience and incident response
This outage illustrates several practical lessons for network operators and defenders:
- Measure traffic as part of an outage investigation. Website checks alone can miss upstream traffic anomalies and routing problems.
- Protect DNS and name server infrastructure with multi-homing, geographically distributed authoritative servers, and diverse transit providers where possible.
- Monitor BGP and routing changes in real time so shifts — whether accidental or deliberate — are detected and evaluated quickly.
- Apply rate-limiting and scrubbing policies at upstream providers or via DDoS mitigation services to absorb volumetric floods.
- Integrate threat intelligence feeds and telemetry to spot emerging botnet behaviors and indicators that could presage larger campaigns.
Closing thoughts
The North Korea outage is a reminder that even isolated or state-limited networks can be vulnerable to globally sourced traffic floods. Kentik’s work demonstrates the value of combining traffic measurement with route analytics to distinguish between equipment failure, routing mishaps, and malicious DDoS activity. Until investigators can tie traffic to a specific actor or botnet, the incident stands as an operational cautionary tale: resilience depends on visibility, diversity of network paths, and rapid mitigation partnerships with transit providers and scrubbing services.
Licensed under CC BY-ND 4.0 International
