Bluesky Restores Service Following DDoS Attack Claimed by Iran-Linked 313 Team

Bluesky, an increasingly popular alternative to Twitter, has returned to normal operations following a significant disruption stemming from a multi-day outage. The issue began on April 15, 2026, around 11:40 PM PDT, when users experienced halted feed updates. By daybreak, functionality deteriorated further, with users unable to receive notifications, search content, or access threads on the platform.

In an official announcement, Bluesky attributed the service interruptions to a Distributed Denial-of-Service (DDoS) attack. This type of cyber assault involves overwhelming the site’s Application Programming Interface (API) with excessive traffic, effectively disrupting communication between users’ devices and the platform’s servers. As a result, millions were left without access to the site.

Throughout the outage, Bluesky maintained a low-profile communication strategy, updating users on X.com with a message indicating they were addressing service interruptions. Their immediate efforts were focused on stabilizing the platform in light of the attack, which they characterized as sophisticated and escalating.

Our team received a report of intermittent app outages at about 11:40 PM PDT on April 15, 2026. They worked through the night to mitigate a sophisticated Distributed Denial-of-Service (DDoS) attack, which intensified throughout the day.

— Bluesky (@bsky.app) 2026-04-16T23:47:25.963Z

Identifying the Attackers

While Bluesky refrained from speculating about the identity of the attackers, a group known as the 313 Team, also referred to as the Islamic Cyber Resistance based in Iraq, claimed responsibility via channels on Telegram. This group has a history of targeting online platforms perceived to support U.S. or Israeli interests.

313 Team’s post on Telegram (source: Heise Medien)

Notably, the 313 Team has links to Iran and has focused its operations on various platforms, including a subsequent attack on mastodon.social on April 20, 2026. However, due to its decentralized server architecture, Mastodon was less affected than Bluesky was during the initial attack.

This group has shown an inclination toward disrupting services for publicity rather than data theft, contrasting with other attacker factions that prioritize data exfiltration. Over the past month, the 313 Team also targeted government websites in Bahrain and has been known to boast about their exploits across social media.

Implications for Data Security

The DDoS attack raises essential concerns regarding the security of personal information among Bluesky’s user base, which exceeds 43.7 million. However, DDoS attacks typically aim to incapacitate service rather than infiltrate systems, alleviating fears regarding personal data breaches. Bluesky confirmed on April 18 that there was “no evidence of unauthorized access to private user data,” reinforcing user assurances.

The application has remained stable since approximately 9 PM PDT, April 16 despite ongoing DDoS attacks. We have not seen any evidence of unauthorized access to private user data. Our next update will follow on or before the morning of April 20.

— Bluesky (@bsky.app) 2026-04-17T20:36:31.198Z

By April 20, Bluesky announced that the application had stabilized, marking the conclusion of the service disruption. Despite ongoing attacks, the platform’s cybersecurity team managed to contain the influx of malicious traffic, restoring normal operations and indicating that the immediate threat had subsided.

Source

Related Posts

Stuxnet Virus Breached Chevron’s IT Network

Nov 09, 2012

The sophisticated Stuxnet virus, developed jointly by the U.S. and Israel to target Iran’s nuclear enrichment facilities in Natanz, also compromised Chevron’s IT network shortly after its public emergence in 2010. Chevron identified the malware in its systems following its initial discovery, noted in a blog post in July 2010, according to Mark Koelmel, general manager of the earth-sciences department at the oil giant. While the U.S. government has never formally acknowledged the Stuxnet initiative, the virus, intended to disrupt systems produced by Siemens for managing critical infrastructure, has been detected in various countries. Reports from the Wall Street Journal suggest that Chevron’s encounter with Stuxnet resulted from the malware’s unintended dissemination.

#opIsrael: Massive Cyber Attack on Israel Amid Gaza Protests

On November 19, 2012, in response to ongoing attacks in Gaza, Anonymous hackers launched a significant cyber assault on Israeli websites. According to government sources, “government and private websites are under siege from hackers, who have mounted 44 million cyberattacks in less than a week.” Additionally, Pakistani hackers defaced major platforms such as Bing, MSN, Skype, and Live. In retaliation, Israeli hackers leaked credit card information from a Palestinian ISP website. Finance Minister Yuval Steinitz reported that while one hacking attempt succeeded on an unnamed site, it was back online within ten minutes. Israel typically faces a few hundred hacking attempts daily, with the current attacks reportedly originating from across the globe. Defense websites have been particularly targeted, with the president’s site receiving 10 million hits, the foreign ministry 7 million, and the prime minister’s page 3 million.

Izz ad-Din al-Qassam Cyber Fighters Renew Threats Against U.S. Banks

Dec 12, 2012

The Izz ad-Din al-Qassam Cyber Fighters have issued a new warning via their Pastebin profile, indicating an imminent wave of cyber attacks targeting American financial institutions this week. Following previous large-scale distributed denial-of-service (DDoS) attacks against various banking websites in September and October, a Bank of America representative confirmed they are “aware of the reports of potential cyber attacks” and emphasized that their systems remain fully operational. In a recent message, the hackers declared, “After a month-long hiatus in our attack against American banks, we are now announcing a new series of assaults.” They aim to address grievances towards the Prophet Muhammad (PBUH) and have expressed through online discussions that these attacks will persist.