DDoS Attacks Disrupt Threema Messaging Service
Summary
Threema said large-scale DDoS attacks targeting its service and colocation partner Nine caused intermittent outages. It added specialized upstream DDoS protection; Threema On-Prem customers were unaffected.
Key points
- Threema confirmed a series of large-scale DDoS attacks that temporarily made its service unavailable or partially available.
- Users reported interruptions in multiple countries, including Switzerland, India, and China.
- The attacks also targeted colocation partner Nine, but Threema said it was unclear whether it or multiple targets were the primary focus.
- Threema said the attacker repeatedly changed tactics, complicating mitigation.
- Threema On-Prem customers were unaffected because they use their own infrastructure.
- Threema implemented specialized upstream DDoS protection to filter attack traffic and reduce infrastructure load.
Article Details
- Victim Organization
- Threema
- Incident Type
- Multiple distributed denial-of-service (DDoS) attacks
- Operational Impact
- The service was temporarily unavailable or partially available on Tuesday evening and Wednesday morning, causing severe communications disruptions and intermittent outages. Threema On-Prem customers were not affected.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
Vendors
NineThreema said the attacks also targeted its colocation partner Nine, and it has since added specialized DDoS protection to reduce future impact.ThreemaMultiple distributed denial-of-service attacks disrupted Threema’s secure messaging service, causing intermittent outages for users in several countries.
Products
ThreemaMultiple distributed denial-of-service attacks disrupted Threema’s secure messaging service, causing intermittent outages for users in several countries.Threema On-PremThreema On-Prem customers were not affected because they use their own infrastructure.Threema Work“Business customers using Threema Work were informed via email on Wednesday morning about the unstable service conditions, and account managers provided information on the current situation in response to inquiries.”
Countries
ChinaThe next day, users in Switzerland, India, and China continued to report that the service was down, despite Threema’s status page showing no problems.IndiaThe next day, users in Switzerland, India, and China continued to report that the service was down, despite Threema’s status page showing no problems.SwitzerlandThe service relies on its own server infrastructure in various locations in Switzerland and promises “no ads, no profiling, no hidden data analyses.”