Sustained DDoS campaign knocked Ubuntu and Canonical sites offline, blocking updates for ~20 hours

Canonical confirmed a sustained distributed denial — of-service campaign began on Thursday against its public — facing web infrastructure, knocking several Ubuntu and Canonical websites offline for around 20 hours. The company posted that “Canonical’s web infrastructure is under a sustained, cross — border attack and we are working to address it. We will provide more information in our official channels as soon as we are able,” and a Canonical spokesperson, Lelanie de Roubaix, reiterated that statement when contacted.

Community forum posts and threat intelligence channels reported the outage affected Ubuntu’s security API and multiple Canonical — hosted endpoints that package managers and update tools rely on. Those reports, together with TechCrunch’s own checks, produced package — fetch failures: TechCrunch verified that updates failed to install on a test device running Ubuntu during the outage, and community developers discussed errors tied to update and installation flows.

A group calling itself The Islamic Cyber Resistance in Iraq 313 Team claimed responsibility for the disruption via a post on Telegram, and related threat posts linked the incident to a DDoS-for-hire service named Beamed. The attackers or affiliated posts said they were using that service to power the traffic surge; the DDoS-for-hire service in this case claims to power attacks in excess of 3.5 Tbps, a scale the source material notes is about half of the bandwidth of a cyberattack Cloudflare previously described as the largest DDoS ever recorded.

The underlying technique involved in this outage is a traditional DDoS: flood the target with junk traffic until services overload. The source describes such campaigns as crude but often effective. It also explains that DDoS-for-hire offerings, sometimes called booters or stressers, enable people with little technical skill to buy attacks, lowering the barrier for large — scale disruptions that investigators and victims must later mitigate.

The incident underscores why software — update infrastructure has become a critical focal point in cybersecurity. Ubuntu is widely deployed across cloud instances, enterprise servers and developer workstations, and its distribution channels therefore represent high-value targets when attackers seek broad disruption. When update endpoints or security APIs are impaired, a large and diverse set of users can be blocked from receiving patches and new packages, compounding operational risk during an active outage.

Responses to the outage are likely to rekindle calls for greater redundancy and resilience in open-source distribution channels, including more geographically dispersed mirrors, stronger partnerships with CDNs and ISPs, and clearer incident playbooks for handling large — scale DDoS. The publicly available reporting does not provide a full technical post-mortem, nor does it independently verify the attacker’s claimed capacity or financial arrangements with any service; those limits mean some operational details about mitigation and root cause remain to be confirmed by Canonical or further investigation.