Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to intelligence
hacktivist-operationoperational-disruptionbotnet-infrastructuregovernment-diplomatic-threat

WikiLeaks Faced Cyberattacks and State Blocking After Publishing Sensitive Leaks

Updated 28d agoFirst seen May 25, 202611 sources

WikiLeaks repeatedly faced disruption tied to high-profile disclosures, including attacks on its infrastructure and government-imposed access restrictions. In one earlier episode, the organization struggled to keep its site online as opponents targeted its domain and hosting arrangements, forcing it to shift providers and addresses to stay reachable. Years later, WikiLeaks said it came under a sustained attack after announcing plans to publish roughly 300,000 emails and 500,000 documents related to Turkey’s political power structure following the failed coup attempt.

After the Turkish document release, authorities in Turkey blocked access to WikiLeaks, escalating the confrontation from network pressure to direct censorship. In a separate but related controversy, WikiLeaks supporters claimed responsibility for the massive Dyn distributed denial-of-service incident that disrupted major U.S. websites, framing it as retaliation for Ecuador cutting Julian Assange’s internet access, but investigators and security researchers said there was not enough evidence to attribute the attack to them and pointed instead to Mirai-driven botnet activity involving internet-connected devices.

Share:
WikiLeaks Faced Cyberattacks and State Blocking After Publishing Sensitive Leaks
Stay ahead

Get ahead of threats like this

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.

EVENT TIMELINE

How this story unfolded

10 events from the most recent confirmed update back to the earliest known activity.

10 EVENTS
Oct 21, 201610y ago

WikiLeaks supporters claim Dyn attack was retaliation for Assange cutoff

Supporters of WikiLeaks, including people claiming affiliation with Anonymous and New World Hackers, said the Dyn attack was retaliation for Ecuador cutting Julian Assange's internet access. Security researchers and U.S. officials said there was not enough evidence to confirm that attribution.

Dyn hit by major DDoS causing widespread U.S. website outages

A large distributed denial-of-service attack struck DNS provider Dyn in three waves beginning shortly after 7 a.m. EST, disrupting access to major websites including Twitter, Spotify, and The New York Times across the United States. Dyn and researchers said Mirai botnet malware was involved, and DHS and the FBI began investigating.

Jul 20, 201610y ago

Turkey blocks access to WikiLeaks after email dump

Turkish authorities blocked access to WikiLeaks after the publication of government-related emails. The move was reported as part of broader internet censorship and controls imposed in the coup aftermath.

Jul 19, 201610y ago

WikiLeaks publishes AKP government email dump

WikiLeaks released a cache of Turkish government and AKP-related emails, prompting a rapid response from Turkish authorities. Reporting tied the release to tensions following the failed coup attempt earlier that month.

Jul 18, 201610y ago

WikiLeaks reports sustained attack before Turkey document release

WikiLeaks said its website was under a sustained ongoing attack after announcing plans to publish documents about Turkey's political power structure. The group said it was preparing to release roughly 300,000 emails and 500,000 documents related to the aftermath of the failed Turkish coup.

Dec 9, 201016y ago

SarahPAC reports DDoS attack amid Operation Payback backlash

Sarah Palin and her aides said SarahPAC's website was hit by a denial-of-service attack during the WikiLeaks-related Operation Payback campaign, and also claimed Sarah and Todd Palin's credit card accounts were compromised. Reports cited a developer who said the LOIC attack tool was used and that server logs contained a message referencing WikiLeaks and Anon_Ops, though attribution was disputed.

Is Palin Just Using 'Operation Payback' to Get Attention? | The Atlantic Wire
Dec 5, 201016y ago

PayPal suspends WikiLeaks donation account amid cable leak backlash

PayPal permanently suspended WikiLeaks' donation account as pressure mounted after the publication of U.S. diplomatic cables. The report also said Amazon had stopped hosting WikiLeaks, EveryDNS had ceased directing traffic to the site, and WikiLeaks was facing denial-of-service attacks.

WikiLeaks hit by new online onslaught | The Independent | The Independent
Dec 3, 201016y ago

Amazon removes WikiLeaks from hosting over cable publication

Amazon stopped hosting WikiLeaks after the site published U.S. diplomatic cables, saying the organization violated its terms of service because it did not own the rights to the material and the release could endanger innocent people. After losing Amazon hosting, WikiLeaks also lost DNS support and was temporarily reachable only by IP address.

WikiLeaks got kicked off Amazon on purpose, says Assange - CNET
Mar 18, 200917y ago

Australia's internet filter trial blocks some WikiLeaks pages

During Australia's trial of a mandatory internet filtering system, some WikiLeaks pages were reportedly added to the blacklist after WikiLeaks published a list of websites banned by the Danish government. The incident drew criticism because the filtering scheme had been presented as targeting illegal child abuse material, but appeared to include other controversial content.

Aussie firewall blocks Wikileaks • The Register
Feb 23, 200818y ago

Julius Baer injunction leads to temporary WikiLeaks domain takedown

Swiss bank Julius Baer obtained a U.S. court injunction that caused domain registrar Dynadot to remove the wikileaks.org domain, temporarily disrupting access to WikiLeaks. The move sparked backlash over internet censorship and drove wider distribution of the disputed banking documents through mirrors and direct IP access.

Whistle while you work | Internet | The Guardian
The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Exposure mapping

Map indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidence

Every observed campaign, victim, and pivot linked to actors named in this story.

Associated malware

Malware, exploits, and IOCs connected to the activity described here.

Detection signatures

YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alerts

Get matching new stories delivered to your team as they break — not the next morning.

AI threads

Ask questions about this story and take action on the answers.