Loading story…
Canonical confirmed widespread disruption across Ubuntu and Canonical web infrastructure after a sustained distributed denial-of-service attack hit ubuntu.com and related services. The pro-Iran hacktivist group The Islamic Cyber Resistance in Iraq (313 Team) claimed responsibility on Telegram, describing the operation as a multi-hour campaign, while reports said the impact lasted more than 12 hours. Canonical acknowledged the outages on its status page and through Ubuntu social channels as teams worked to restore availability.
The incident affected core services including website access, Canonical account logins, developer portals, package and security endpoints such as archive.ubuntu.com, security.ubuntu.com, and Ubuntu Security API resources for CVEs and notices. The disruption interfered with Ubuntu downloads, package installation, system updates, vulnerability-data retrieval, and automated patching workflows used by administrators worldwide. A follow-up message from the group introduced an apparent extortion angle, warning Canonical to make contact or face continued attacks, although no motive for targeting the company was publicly stated.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
An oss-sec mailing list post reported on Saturday that ubuntu.com, canonical.com, snapcraft.io, and security.ubuntu.com were reachable again, with successful DNS resolution and no observed packet loss. The post also showed a successful `apt update`, indicating package-related services had resumed after the prior DDoS disruption.
In a follow-up message, 313 Team told Canonical to contact the group or face continued attacks, indicating a shakedown element beyond the initial hacktivist claim. The motive for targeting Canonical was not otherwise stated.
Canonical confirmed the outages through its status page and Ubuntu's official X account, saying teams were working to restore full availability and would provide updates through official channels. At the time of reporting, Canonical had not publicly attributed the disruption to a DDoS campaign.
During the ongoing attack on Canonical's public-facing infrastructure, some users were reportedly unable to update or install Ubuntu packages. TechCrunch said it verified update failures on a test Ubuntu device, indicating the disruption extended beyond websites to package-related services such as the security API.
Canonical's main website and multiple subdomains experienced sustained disruption for more than 12 hours, affecting ubuntu.com, canonical.com, account access, downloads, developer portals, and security-related endpoints. Some services such as Archive and Discourse reportedly remained available during parts of the incident.
The pro-Iran hacktivist group The Islamic Cyber Resistance in Iraq, also known as 313 Team, announced on Telegram that it was conducting a distributed denial-of-service attack against Canonical's infrastructure and said the operation would last four hours.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcetomshardware.com
Open sourcearstechnica.com
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcetechcrunch.com
Open sourcego.theregister.com
Open sourceaskubuntu.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ubuntu package repository access was disrupted after regional archive mirrors for the US and Canada failed to resolve correctly, leaving administrators unable to reliably reach package infrastructure. Reports indicated that `ca.archive.ubuntu.com` returned a CNAME to `us.archive.ubuntu.com`, while `us.archive.ubuntu.com` had no DNS record, pointing to a DNS or service availability failure rather than a routine mirror outage. Canonical's status page also showed problems affecting `security.ubuntu.com`, expanding the impact beyond regional mirrors to Ubuntu's security update channel. The incident raised immediate operational risk for organizations that depend on Ubuntu repositories for package installation, patching, and automated update workflows, although no confirmed root cause was publicly provided in the referenced reports.
Jul 23, 2026
Cyber activity surged immediately following joint **U.S.–Israel strikes on Iran** (described as *Operation Epic Fury*), with reporting indicating a fast-moving “cyber swarm” of hacktivists and aligned collectives conducting disruption, influence messaging, and broad cyber claim activity within hours of the kinetic events. A day-by-day Telegram-focused timeline described early **DDoS campaigns against Israeli government sites** expanding into a wider coalition of **pro-Iranian, pro-Palestinian, and Russian-aligned** groups targeting additional regions and sectors, including Gulf states, Europe, and the U.S., with increasing attention on **critical infrastructure**; examples cited include claims of DDoS disruption against Israeli commercial, defense-adjacent, and energy-related entities (e.g., an oil company and an advanced defense firm), sometimes accompanied by third-party availability “verification” links. U.S. state and local governments were separately warned by **MS-ISAC** to expect heightened “low-level” activity—particularly **DDoS**—in the wake of the Iran-related escalation, and were urged to harden internet-facing and cloud services (e.g., remediation of critical/cloud infrastructure, use of firewalls/CDNs, and reducing exposed employee/organizational data). In parallel, a critical-infrastructure-focused interview tied to an upcoming OT security summit reiterated that energy, water, pipeline, and ICS environments face persistent probing by state adversaries and that “low-cost entry” cyber operations can be used to test and disrupt mission-critical systems; while not specific to the Iran conflict, it reinforces the broader risk context for OT operators amid heightened geopolitical tensions.
Jun 29, 2026
Twitter’s website was briefly hijacked after attackers using the name **“Iranian Cyber Army”** compromised the company’s DNS records and redirected visitors to a black defacement page carrying political messages, an Iranian flag, and contact details. The outage lasted about an hour, and users attempting to reach `Twitter.com` were sent to the spoofed page instead of the service. Reporting indicated the redirection was carried out with a valid Twitter username and password, suggesting the incident stemmed from compromised internal credentials rather than a vulnerability at DNS provider Dyn. Twitter said the DNS issue was fixed quickly and that its API and platform applications continued operating during the disruption, while the attack drew added attention because of Twitter’s role in communications around Iran’s disputed election protests.
Jun 29, 2026