North Korea’s Websites Went Dark for 32 Hours; Network Analysts Point to DDoS Traffic

SEOUL, October 24, 2026 — A wave of abnormal internet traffic appears to have contributed to widespread disruptions of North Korean websites this week, according to a network-monitoring analysis reported Friday. The finding offers a possible explanation for outages that left state-run websites intermittently unreachable for roughly 32 hours, but investigators have not identified who was responsible.

Doug Madory, director of internet analysis at U.S. network-monitoring company Kentik, told Reuters on October 23 that several waves of incoming traffic coincided with outages beginning around 11 a.m. local time on October 20. The traffic pattern was consistent with a distributed denial-of-service, or DDoS, attack — an attempt to overwhelm online services with requests.

More than 40 websites using North Korea’s .kp domain were affected, according to South Korean reporting cited by Reuters. The affected services reportedly included the foreign ministry’s website and the Korean Central News Agency, the state news organization.

What is known — and what is not

Kentik observed traffic originating from networks in several countries, including Vietnam, the Philippines and Venezuela. Those locations do not establish who directed the traffic. Madory also cautioned that Kentik examined only part of the traffic heading toward North Korea, leaving the attack’s full scale uncertain.

The interruptions themselves were documented before the DDoS assessment emerged. On October 21, specialist publication NK News reported that virtually all North Korean websites had become intermittently inaccessible, including multiple state-media outlets. Earlier speculation included infrastructure or power-supply problems. The later traffic analysis strengthens the case for an attack but does not independently rule out every other contributing fault.

The episode underscores the vulnerability of a relatively small, centralized set of publicly reachable online services. A disruption to the network infrastructure used by many government websites can have an outsized effect on information flowing out of the country.

As of the October 23 reporting, there was no verified public attribution of the suspected attack to any government, organization or individual.

Featured image: Archival photograph of the Pyongyang skyline taken April 30, 2010. It does not depict the October 2026 outage. Photo: John Pavelka / Wikimedia Commons, CC BY 2.0. Image resized automatically for responsive display.

Reporting sources: Reuters (Oct. 23); NK News (Oct. 21).

Please follow and like us: