Team Cymru Finds DDoS-Like Traffic Spike Targeting Venezuela’s Electoral Council
Summary
Team Cymru's NetFlow analysis found a 34-minute traffic spike targeting a CNE-linked IP during Venezuela's 2024 election, consistent with a possible DDoS attempt. The source and impact remain unclear; the data did not support claims of North Macedonian origin.
Key points
- Traffic to IP 201.130.83.39, linked to CNE services, spiked on election day, July 28, 2024; the IP accounted for 98% of the observed traffic increase.
- The unusual activity lasted about 34 minutes, beginning at 11:29 a.m. local time, and mainly involved UDP connections from numerous remote hosts.
- Team Cymru observed just under 6,000 IP addresses across 110 country codes; 86% were assigned to providers in Czechia and South Africa.
- Passive DNS linked the targeted IP to two CNE login portals, but the available NetFlow data could not determine which service was targeted.
- The traffic pattern was consistent with a possible DDoS attempt, but whether it disrupted access to the portals is unclear.
- The analysis did not support the claim that the activity originated in North Macedonia; responsibility and intent remain unknown.
Article Details
- Attack Vectors
- A suspected distributed denial-of-service attack produced a spike of UDP connections from numerous remote hosts to the CNE-associated IP 201.130.83.39. The activity lasted approximately 34 minutes; occasional TCP activity was also observed. The available data does not identify which service on the IP was targeted or establish who was responsible.
- CNE and Nicolás Maduro attributed the election-day delay to a cyberattack allegedly originating from North Macedonia, but the article says its findings do not support that attribution.
- Defensive Notes
- The article recommends robust measures to protect electoral infrastructure from disruption.
- Team Cymru describes its no-cost, BGP-based Unwanted Traffic Removal Service (UTRS) as a tool for mitigating large and concentrated DDoS attacks.
MITRE ATT&CK
Vendors
Products
Pure SignalIn this blog post we will examine these “cyber attack” claims by analyzing high-level network telemetry data, derived from Pure Signal™.SAFEsafe.cne.gob[.]veSICOFPEsicofpe.cne.gob[.]veUTRSTeam Cymru’s Unwanted Traffic Removal Service (UTRS), is a no cost BGP-based service that is an effective tool to help mitigate large and concentrated DDoS attacks.
Countries
Czechiatraffic spike; just under 6,000 in total, we found that the majority (86%) were assigned to providers in Czechia and South Africa. In all, we observed 110 distinct country codes.North Macedoniascheduled. Both the CNE and Maduro attributed this delay to a "cyber attack" allegedly launched from North Macedonia.South Africajust under 6,000 in total, we found that the majority (86%) were assigned to providers in Czechia and South Africa. In all, we observed 110 distinct country codes.VenezuelaOn July 28, 2024, Venezuela held presidential elections to determine who would lead the nation for the next six-year term. The government-controlled Consejo Nacional Electoral (CNE) declared incumbent Nicol√°s Maduro
Industries
Electoralwho would lead the nation for the next six-year term. The government-controlled Consejo Nacional Electoral (CNE) declared incumbent Nicol√°s Maduro the winner, a result that remains heavily disputed byGovernmentheld presidential elections to determine who would lead the nation for the next six-year term. The government-controlled Consejo Nacional Electoral (CNE) declared incumbent Nicol√°s Maduro the winner, a result