Pro-Iran crew turns DDoS into shakedown as Ubuntu.com stays down

Canonical says its web infrastructure is under attack after a pro-Iran hacktivist group instructed its members to target the open source giant. "I can confirm that Canonical's web infrastructure is under a sustained, cross-border Distributed Denial of Service (DDoS) attack" a Canonical spokesperson told The Register.  "Our …

[TVU]

The least impolite thing I can say about these hackers is that they are complete and total scumbags.

[Yet Another Anonymous coward]

If they really are Iranian can't they express their views in the proper manner by a stiffly worded letter to the US defense dept ?

[Lusty]

No, because the US no longer has a defense department.

[Yet Another Anonymous coward]

Is there a dept of "Special operation which we already won before it started and anyway it's all over now"?

Presumably with very long business cards

[Ian Bush]

ITYM "very bigly business cards"

[Yet Another Anonymous coward]

Indeed the biglyist

[GBE]

bigly like has never been seen before!

[bombastic bob]

they just rage against everyone

Their only goal is to elevate their own relevance by terrorizing as many people as possible, whether or not it is related to the USA and Department of War and the Trump administration.

They're like babies who throw food because they didn't get what they wanted.

I have been personally seeing a lot of traffic from Brazil and Uraguay, and complaint e-mails sent to those ISPs all bounce. Basically it's the entire netblock from those countries listed in my firewall block list. These IP addresses were sending SYN floods to port 443 and the only fix was to block the IP addresses from which they came. I also tightened up my DNS a bit 'cause they were trying to DDoS that via recursive requests (default FreeBSD config did not disallow this) so i fixed the config to stop THAT.

This activity was occasional up until the attack on Iran, after which it increased a LOT. And I don't even have a high traffic site, just a locally hosted web page with my own domain that's on a fixed IP for testing and prototyping things, but I noticed the disruption whenever their DDoS's ran.

Grok analysis was that it was likely a "test run" or series of them, mostly irritating [like making certain web sites or e-mail go slow] and revealed that servers in Brazil are known to be used for "penetration testing" like that.

[brep51r]

disturbing timing

given the recently disclosed privilege escalation vulnerability in the Linux kernel. bad time to be unable to access your distro’s guidance.

https://arstechnica.com/security/2026/04/as-the-most-severe-linux-threat-in-years-surfaces-the-world-scrambles/

[That Badger]

Re: disturbing timing

You can just get a kernel from kernel.org and compile it yourself.

[That Badger]

Re: disturbing timing

24 thumbs down? Are ubuntu users incapable of doing something as simple as fetching and compiling a kernel by themselves?

[mickaroo]

Re: disturbing timing

Now up to 29 downvotes at the time of reading. Rock on...

And the answer to your question is... No, the majority of Linux USERS have never built a kernel and will never need to. They're USERS, not DEVELOPERS.

And yes, I use Linux. And yes, I built a kernel from sources once. It was lengthy, confusing, and certainly not easy for a novice. But it did boot.

[That Badger]

Re: disturbing timing

Compiling a kernel doesn't make you a developer. It really isn't that diffcult either.

There's no reason why a self-compiled kernel wouldn't boot, unless you unchecked essential drivers for some inexplicable reason.

I'm getting really disappointed at where this site is going, seems like the herd-mentality of "oh, it's been downvoted once, i must downvote too, even though i have no idea why i'm doing it" is infecting it.

Don't let this become another reddit.

[herman]

Re: disturbing timing

Ayup, there are precious few card carrying geeks left on this site.

Kids, these days...

[Anonymous Coward]

Re: disturbing timing

And when you have a fleet of hundreds or thousands of servers to update? The "family basement" approach doesn't work....

[Anonymous Coward]

Re: disturbing timing

> They're USERS, not DEVELOPERS.

"A basic Unix user is that who has only ever written one device driver"

[Anonymous Coward]

Re: disturbing timing

> It was lengthy, confusing, and certainly not easy for a novice.

Not a Gentoo user, I see.

Btw, in the 90s doing a make menuconfig was the usual way in which one upgraded one's kernel.

[sedregj]

Re: disturbing timing

menuconfig? Luxury! make config. Not make xconfig because your CRT monitor makes a strange humming sound and has a strange green tint after mucking up a modeconfig.

Then you forget to sort out lilo and have to reach for the boot floppy.

[David Hicklin]

Re: disturbing timing

> No, the majority of Linux USERS have never built a kernel and will never need to

I am in that band, been in IT for 30+ years, seen and done most of it - and quite capable of compiling a program or whatever.

And also a recent migrant from windows 10 (for me it IS the last windows ever) to Mint - and I want an OS that *just works* and Mint ticks all the boxes just nicely.

Sure the hardcore geeks can go and get the latest kernel and compile it but the general public have no knowledge of how to do this - nor should they need to especially if we are going to get them off Windows and onto linux , after all do people recompile Windows every time it goes wrong ? (ignoring that you can't get the Windows source files !)

[doublelayer]

Re: disturbing timing

One problem with your comment is that some of us have been getting others onto Linux or suggesting that governments or companies do. The more people do that, the lower the percentage of Linux users who know how or why to compile a kernel will be. If you want Linux to only be for the IT types, your comment makes more sense, but most of us disagree with you. If you don't want that, then you're overestimating how common that knowledge is.

But let's take my example, since I can and have compiled kernels before. It's not that hard, but in order to drop in a replacement, I need to be careful about which version and which features get configured into it so they match the rest of the config, a config I intentionally chose not to create because the distro creators' one is fine. Can I do that? Sure. Is it as simple as grabbing the sources and running the build? No, I have to do plenty more work. You've interpreted opposition to your comment as people being unable to do what you recommend. Sometimes, people have reasons for not doing something or doing it but not wanting to other than incapability.

[That Badger]

Re: disturbing timing

This was my solution to the problem of people wanting to fix a problem right at that moment instead of waiting a bit until the respository was accessible again (or using the mitigations avaiable by doing a quick google search). Apparently this was some kind of sin that "needed" downvoting.

[Anonymous Coward]

Re: disturbing timing

> Apparently this was some kind of sin that "needed" downvoting.

Remember: people don't read what you write. They read what they think you wrote (if they're kind) or what they want to read (everyone else). Also, it's always someone else who's the stupid one.

[DrXym]

Re: disturbing timing

"Just" is doing a lot of heavy lifting here

[Anonymous Coward]

Re: disturbing timing

> "Just" is doing a lot of heavy lifting here

To be fair, the process has hardly changed in the last thirty years.

When doing embedded stuff one ends up compiling the kernel from source most of the time.

[DrXym]

Re: disturbing timing

I've built kernels from source on multiple occasions and it's always a pain in the arse even if you know how to do it.

[Anonymous Coward]

Re: disturbing timing

> it's always a pain in the arse even if you know how to do it.

Some people do enjoy that sort of thing, others don't, others just do it for the money.

It's the same with kernels.

[Kevin McMurtrie]

Re: disturbing timing

All of the how-to guides for compiling the Linux kernel are 5 to 10 hours long. Getting the correct dependencies is no trivial matter.

[TKW]

Re: disturbing timing

I hope so! Gatekeeping Ubuntu availability to people who have the tech expertise to compile and install a kernel would be sad.

[Anonymous Coward]

Re: disturbing timing

Good way of showing why normal people shy away from the Linux crowd...

[BFeely]

Re: disturbing timing

The Ubuntu apt repository seems to be working fine for me. Just updated the kernel on my web server. Then rebooted so the patched kernel would load.

[Tom Chiverton 1]

Re: disturbing timing

The repos were fubar for at least several hours last night

[DoctorNine]

Re: disturbing timing

Well, when the attack hit, I was updating one of my machines, and thought for a moment it was simply the internet connection. Then I queried the connection and found the problem. So instead, I just cleaned files and went to bed. By the time I woke up, it was fine.

However, I would like to point out to any IRGC apologists out there, that such indiscriminate flailing about simply makes more people hate the regime. Shooting ballistic missiles at your neighbors and targeting tech repositories might make enemies of people who were either neutral or sympathetic to your cause. Simply, it is a bad plan.

[Anonymous Coward]

Re: disturbing timing

Ubuntu repos did work, PPA ones didn't.

[David 132]

Re: disturbing timing

It's clearly a distraction attack to allow them, or an allied crew, to do something nefarious in the Ubuntu repos while everyone's panicking about Copy Fail.

[That Badger]

Re: disturbing timing

Are you under the impression that DDoSing a site somehow makes it more hackable? It does not.

[very cowardly anonymous]

Re: disturbing timing

It is a LOCAL exploit and was fixed 4 weeks ago. If your distribution did not update their kernel 4 weeks ago, switch. If you haven't installed updates in that timeframe, get off the internet

[Anonymous Coward]

Re: disturbing timing

I'm a long time Linux user but the only kernel I care about is the one who charges almost thirty quid for a bucket

[Anonymous Coward]

Wouldn't it make more sense for them to go after Palantir?????

[retiredFool]

or microsoft? Or oracle, or ??? Ubuntu what are they thinking. My only thought is ubuntu is big, but not so big that they can do a successful attack.

[Snowy]

Could be they are thinking that they where an easier target?

Ubuntu has less money to put in place mitagation for this type of attack?

[Simon Reed]

The already did Microsoft. DDoS of MS365 for about 5 hours.

[Anonymous Coward]

Given MS’s reputation, it’s not surprising no one noticed…

[intrigid]

Because almost 100% of MS365 users are using it because their job pays them to. Who would complain about unexpected downtime?

[That Badger]

It might have been to keep ubuntu users from updating, therefore keeping the exploit exploitable for a bit longer.

[Benegesserict Cumbersomberbatch]

Unfortunately, no one is talking sense.

A US administration lacks the skills, intelligence or courage to end the war it started. It attacked Iran without a casus belli. That country feels obliged to make the whole world share as much of its pain as possible.

Every other country in the world is now in a zero sum game of Whom Do We Loathe More?

[Anonymous Coward]

> That country feels obliged to make the whole world share as much of its pain as possible.

When you read "the whole world"in the Western news, it means "the West".

Westerners tend to think *they* don't live in a bubble. Well… :)

[Jimjam3]

I’m sure Japan, South America and South Korea are not Western?

[Anonymous Coward]

Probably just because Karp can ask its company to identify them and then ask Hegseth to direct a missile at them.... this kind of people never attack dangerous targets.

[IGotOut]

I'm confused why...

....the only thing I can think of is it's registered in the UK. Unless it's a smokescreen for a different attack.

[Not Yb]

Re: I'm confused why...

That's what I'm thinking as well. Any target company running Ubuntu on their devices is probably ALSO under attack right now via unpatched vulns. While the patch mirrors are probably still up, since there's more than just a few of those, the instructions for patching out the attacked vulnerability aren't available.

Luckily the instructions are (as usual) "update to latest security release using known good mirrors".

[Liam Proven]

Re: I'm confused why...

> registered in the UK

Excuuuuuuuse me.

Canonical Ltd

1 Circular Road

Douglas, Isle Of Man

IM1 1AF

Not in the UK at all. About 100km across the sea from the nearest bits of the UK, in fact.

Although on a clear day, from here in the office of the Irish Sea wing of Vulture Towers -- 600 metres from the official Canonical address -- I can see the hilltops of the Lake District.

Today is _not_ a clear day.

[cd]

Re: I'm confused why...

A Manx ca...

[IGotOut]

Re: I'm confused why...

Depends on which variant you look at

Wikipedia has London as their registered headquarters, as do most other sites.

Then you have:

Correspondence Address for all companies:

Canonical Group Limited,

3 More London Riverside

London

SE1 2AQ

United Kingdom

Canonical Group Limited

5 New Street Square,

London EC4A 3TW,

United Kingdom

Canonical UK Limited

5 New Street Square,

London EC4A 3TW,

United Kingdom

https://canonical.com/legal/companies

Then you have.

Company Information

Company Number 06870835

Company Name CANONICAL GROUP LIMITED

Address 5 New Street Square

5 New Street Square

London

EC4A 3TW

ENGLAND

Company Category Private Limited Company

Company Status Active

Origin Country United Kingdom

Incorporation Date 2009-04-06

[MONK_DUCK]

Re: I'm confused why...

I think the London based Canonical Group Limited with +£250 million revenue is what you are after. The none Group company is based in the Isle Of Man. As such as far as I know they'd have to pay the appropriate taxes, but I'm not a tax expert.

[Anonymous Coward]

Re: I'm confused why...

1 Circular Road is Standard Bank…

Uk Gov company information indicates it was a correspondence address used between July 2009 and may 2013.

https://find-and-update.company-information.service.gov.uk/company/06870835/officers

[Anonymous Coward]

Re: I'm confused why...

Canonical has registered entities in the Isle of Man. Canonical Limited and Canonical Services Limited are registered at 2nd Floor, Clarendon House, Victoria Street, Douglas, IM1 2LN. However... The company is globally distributed, with its primary base in London and other offices in cities like Austin, Boston, Shanghai, and Tokyo. Notably, CANONICAL GROUP LIMITED -- Company number 06870835, registered office address 5 New Street Square, 5 New Street Square, London, England, EC4A 3TW, and listed as currently active with the next account statement due Sep 2026 ;)

PS Canonical Group Limited is the primary operating company and the main entity listed for legal and commercial agreements within the Canonical corporate structure

No way would I post that other than as an AC

[TimMaher]

Re: I'm confused why...

Writes note for later…

“Must have chat with Rees-Mogg.”

[Tron]

Would it not be a plan to have spare domains?

Relying on one seems unwise.

[doublelayer]

Re: Would it not be a plan to have spare domains?

It wouldn't make a difference. They're not attacking resolution of a domain. They're attacking the multiple servers serving that domain, including some targeted subdomains. The solution is more servers, and you could easily have those serving one domain anyway, but more servers is expensive and Canonical wants to be efficient.

[Tron]

Re: Would it not be a plan to have spare domains?

I was talking loosely. Having the basic files that people need to access whilst the primary servers are under attack, on other servers, with a different domain, set up at speed or ready, to go live when required. You can program the alt locations into the OS, to switch to in an emergency as a Plan B that is not otherwise advertised. Or the major Linux distros could offer server space to each other for incidents like this. Is it such a bad idea that you all jump in with downvotes. The idea that the internet just routes around stuff has to die. We are being censored by governments and attacked by malign hackers. Everything digital needs a Plan B, because everything digital will fall over sooner or later.

[MONK_DUCK]

Re: Would it not be a plan to have spare domains?

In theory, however the attackers would just attack both instead. Now you could suggest you have twice as many servers and dpuble the bandwidth available for such an eventuality, but that would be extremely expensive and may not even resolve the issue.

[doublelayer]

Re: Would it not be a plan to have spare domains?

"I was talking loosely."

Were you really? Because if that's actually what you were doing, this might be a useful lesson in talking specifically enough that you don't appear to be talking about something else plausible but completely different. I did not downvote either of your comments, but don't be surprised when people interpret "spare domain" as another domain and explain why that wouldn't work.

And, unless you're still talking loosely and mean something other than what you say, it still wouldn't help. There are a few ways to do that, most of which they already did. Backup servers on a backup domain would be easily located, requiring a one-line change to their attack software. Since it's in a public operating system, they could easily find it before starting so they didn't even have to do that. There would be no improvement other than the extra servers, and since you could just have taken some of the ones being attacked and moved them to your backup system, you wouldn't even need those. That would be very easy to build but very ineffective.

The next suggestion is lending space to others. They've got that, it's called mirrors. There are a lot of those. That's one reason the archives weren't down very long compared to the rest of the systems, because it was easier for people to take load off them by switching to mirrors outside the usual ones used and because Ubuntu already distributes load across quite a few of them.

[Nate Amsden]

archive was down

Unsure for how long but for me at least a couple of hours yesterday, I was assuming due to lots of folks trying to patch the kernel bug. It stabilized eventually well enough to get my aptly mirror to fully sync. Stumbled upon the Ubuntu status page and saw all the red, last I noticed last night they had 16 sites in major outage still.

During the 2 or 3 hours I noticed it, aptly was saying timeout for http headers, manually testing showed it taking about 30 seconds to process a request.

Another similar situation a few months back again a kernel package thing, though in that case I think it was just somehow that one package, which was a huge file was timing out for hours.

[Anonymous Coward]

Go after Red Hat; US based and they are known to support the Department of Defense

[Anonymous Coward]

They're Indian.

What Cannonical should be doing it working with the courts and ISPs and make sure that all of the attacking computers lose internet access for at least 30 days.

[Manolo]

Working with the courts in Iraq and Iran? Good luck with that.

[Anonymous Coward]

If all of the traffic is coming from Iraq, then talking to a couple of backbone providers should fix it relatively quickly.

[doublelayer]

DDoS attackers usually have access, either what they built or something they bought*, to a bunch of machines that aren't theirs. Otherwise, attacks are too easy to defend against. It's probably not even mostly coming from Iraq.

* The most common is buying the access from people smarter than them because most people who use DDoS attacks are pretty stupid as online attackers go. The attacks aren't very effective and burn lots of resources, so they're frequently run by people who don't have the skill to do anything else, and that often includes building the botnets needed to run the attack in the first place.

[Gene Cash]

Pro-Iran?

Are we sure they're not anti-systemd and anti-wayland?

[Anonymous Coward]

why

Can't they go after orange mans shit, his familys shit and gegsbreath. And all orange mans golf courses. If they can't take bookings, that would be fun.

[Anonymous Coward]

Re: why

Anti Social Untruths!

[Anonymous Coward]

Re: why

It's really cool and clever how people like you manage to cram your political obsessions into every single discussion, no matter how unrelated.

Whether it's "hur hur thanks Obama" or "hur hur orange man bad", it's witty, sharp, original, and creative; it'll certainly win hearts & minds and converts to your side. Give yourself a pat on the back, why not.

[Anonymous Coward]

Re: why

Does the emphasis on orange colour reflect racism towards Scottish people and people of Scottish descent?

Off topic in a different way, in times of war I think paying ransoms to fund the bad guys might be less legal than usual.

To me Ubuntu is a target of low enough value that trading a little downtime in exchange for identifying a huge number of infected computers and fixing them would be a net gain. To make it fair, maybe install Ubuntu as the fix.

[Simon Reed]

Re: why

Paying ransoms is always the wrong thing to do. It is selfish, naïve, spineless and dos not make the problem go away. You don't pay extortion or ransom demands once, you have to pay them until you have nothing left to give.

[Not Yb]

Re: why

There was a recent news report about some of the so-called "ransomware experts" actually working for a ransomware gang. Just in case we really needed another reason not to pay ransoms for data.

[Anonymous Coward]

Re: why

> Paying ransoms is always the wrong thing to do

Yup, that's right up there with "we never negotiate with terrorists". :-)

FYI:

- We (governments / corporations) *always* pay ransoms if possible

- We *always* negotiate with terrorists

I understand that the general public are led to believe otherwise but that's really not how it works.

[anonymous boring coward]

Re: why

"*always"*?

Is this (always) true?

[Anonymous Coward]

Re: why

> Is this (always) true?

Obviously, no absolute is always true (not even this one), but close enough.

It's the same logic why corporations (and countries) choose to settle lawsuits they believe they could win, even when they are innocent of the claims. It's just seen as more effective.

As for terrorists, that is what you call the opposition's freedom fighters. Mrs Margaret Thatcher let's not negotiate position did not end the troubles. Mr Anthony Blair's let's negotiate position led to the good Friday agreement (this is not an endorsement of either politician, just an illustration via two well-known examples).

[Fruit and Nutcase]

Re: why

Mrs Slocombe's [My Ginger] Pussy is also not amused

[brep51r]

Re: why

i don’t even live in Ameristan but seeing as this war has led to the biggest fuel disruption in history, i think it’s understandable that people are a little miffed

[DoctorNine]

Re: why

You must be young. This isn't even close to how bad it was in 1973. Not at all.

[Anonymous Coward]

Re: why

> This isn't even close to how bad it was in 1973.

I'm not young and I disagree. I believe the difference in perception is a result of the refinement of the consent manufacturing machinery over the intervening years.

[Simon Reed]

Re: why

They did Truth Social last June.

[Pirate Peter]

Re: why

"They did Truth Social last June."

they won't do it again

as why take down the site (although the tangerine tyrant owns it) as he makes himself look more stupid than the worst village idiot, and gives away information about what he is planning

[vekkq]

actually a great way to get always-on ideas out of business heads. where can i sign up?

[Anonymous Coward]

Embarrassing that a tech company can't deal with this...

[xyz123]

Simple way to end pro-iran extortion.

Make them tick a box saying "I eat pork" in order for money transfers to go through.

[Anonymous Coward]

Big bad bug. Small quick mitigation.

Go to https://cert.europa.eu/publications/security-advisories/2026-005/

Go down a few lines, look for ''Temporary Mitigation"

Read the paragraph, and follow

There, that didn't hurt, now did it

Anon for reasons

[Groo The Wanderer - A Canuck]

"Why the group is targeting London-based Canonical remains unclear and no reason was given via its Telegram channel. It is presumably because Ubuntu is one of the most popular Linux distros."

Doh! Canonical is an AMERICAN company...

[Excused Boots]

"Doh! Canonical is an AMERICAN company...”

Really? Not apparently what the rest of the world believes.

OK yes I do know it may be difficult for some people to accept that the ‘good ol USA’ didn't actually invent everything and that there is an entire world beyond the US - but reality!

[Groo The Wanderer - A Canuck]

Well, yes, as I did find out after your comment was posted, Canonical is not a US company.

But they sure as hell were quick to jump on the age/identity verification bandwagon, and you can expect them to kowtow the same way to any future demands for a remote kill switch or "Recall" style functionality to be baked into the OS at the behest of the good old fashioned dictatorial USG.

Still, I wonder what their investor nationality percentages look like...

[Paul Hovnanian]

Lots of stuff is down

I'll spare them the the embarrassment of naming them. But one engineering site I use went down the other day. And they had only just started using CloudFlare for DDoS/Bot protection (I noticed the "security check popups about a week ago). So I checked https://www.isitdownrightnow.com/. Not only is the engineering site reported down. But so is CloudFlare.

[Fruit and Nutcase]

DarkCloudFlare

When CloudFlare is... down

[John Klos]

Re: Lots of stuff is down

"https://www.isitdownrightnow.com" is problematic. It says lots of things are down that aren't, you know, down.

[Paul Hovnanian]

Re: Lots of stuff is down

True. CloudFlare is a very large and distributed CDN (among other things). The fact that I may see something as up doesn't mean that you or isitdownrightnow.com will see the same thing*. Or vice versa. But you'd think that a company who's primary service is protecting against DDoS attacks could keep their own site up.

*This applies to CloudFlare's customers as well. Since each exit in their CDN could be under a different level of attack, some will be up and others down for users geographically near each portal.

[hamiltoneuk]

Launchpad up

Launchpad is working again. Is this the longest outage so far?

[Pirate Peter]

tangerine tyrant screws normal people yet again

so it started with his tariffs that screwed over all Americans and many other people around the world

then he started this Iran war (which Putin loves as it splits American resources for war and less support for Ukraine)

due to the war Iran has blockaded the straight of hormuz, meaning fuel prices are up screwing everyone globally

due to fuel issues airlines will be cancelling flights meaning globally people are being screwed again for holidays etc (wait for food prices going up yet again and shortages due to flight cancellations / aviation fuel shortages)

now it's disrupting our hobbies with ubuntu being targeted

thank god the tangerine tyrant has no more terms in office he can run for,

[anonymous boring coward]

I think they might be attacking the wrong target.