Threema and Nine: Large-scale DDoS attacks disrupted Threema secure messaging service

Threema Hit by Persistent DDoS Attacks, Causing Widespread Service Disruptions

Earlier this week, Threema, the Swiss-based end-to-end encrypted messaging service, suffered a series of large-scale distributed denial-of-service (DDoS) attacks that disrupted user communications. The attacks began on Tuesday around 6 PM UTC, with users reporting delays and connection issues. Initially, Threema attributed the outages to a network problem with its colocation partner, Nine, but later confirmed the disruptions were caused by ongoing DDoS attacks.

The service, known for its privacy-focused features including no ads, profiling, or data analysis experienced intermittent outages across multiple regions, including Switzerland, India, and China. While Threema’s status page indicated normal operations, users continued to face connectivity problems into Wednesday. The company acknowledged that the attacks were unusually persistent, with threat actors constantly shifting tactics to bypass mitigation efforts.

Threema’s on-premises customers, who rely on their own infrastructure, remained unaffected. However, business users of Threema Work were notified via email about the unstable conditions. The company noted that while DDoS attacks are typically mitigated with minimal impact, this incident proved challenging due to its scale and the attacker’s adaptive strategies.

In response, Threema has implemented additional DDoS protection measures to filter malicious traffic upstream and reduce strain on its infrastructure. The company also clarified that it was unclear whether Threema was the primary target or if the attacks were part of a broader campaign against multiple services.

Source: https://www.bleepingcomputer.com/news/security/large-scale-ddos-attacks-disrupted-threema-secure-messaging-service/

Threema cybersecurity rating report: https://www.rankiteo.com/company/threema

Nine Internet Solutions | Your Cloud Navigators cybersecurity rating report: https://www.rankiteo.com/company/nine-internet-solutions-ag

"id": "THRNIN1786904641",
"linkid": "threema, nine-internet-solutions-ag",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Users in Switzerland, India, '
                                              'and China',
                        'industry': 'Technology (Messaging/Communication)',
                        'location': 'Switzerland',
                        'name': 'Threema',
                        'type': 'Company'}],
 'attack_vector': 'Distributed Denial-of-Service (DDoS)',
 'customer_advisories': 'Users were informed via status page updates.',
 'date_detected': '2023-11-14T18:00:00Z',
 'description': 'Threema, the Swiss-based end-to-end encrypted messaging '
                'service, suffered a series of large-scale distributed '
                'denial-of-service (DDoS) attacks that disrupted user '
                'communications. The attacks began on Tuesday around 6 PM UTC, '
                'with users reporting delays and connection issues. The '
                'service experienced intermittent outages across multiple '
                'regions, including Switzerland, India, and China. The company '
                'acknowledged that the attacks were unusually persistent, with '
                'threat actors constantly shifting tactics to bypass '
                'mitigation efforts.',
 'impact': {'brand_reputation_impact': 'Potential impact due to service '
                                       'disruptions',
            'downtime': 'Intermittent outages over multiple days',
            'operational_impact': 'Disrupted user communications and '
                                  'connectivity issues',
            'systems_affected': 'Messaging service infrastructure'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'DDoS attacks can be unusually persistent and adaptive, '
                    'requiring dynamic mitigation strategies.',
 'post_incident_analysis': {'corrective_actions': 'Implementation of '
                                                  'additional DDoS protection '
                                                  'measures',
                            'root_causes': 'Large-scale DDoS attacks with '
                                           'adaptive tactics'},
 'recommendations': 'Implement robust DDoS protection measures and upstream '
                    'traffic filtering to mitigate future attacks.',
 'references': [{'source': 'Cyber Incident Description'}],
 'response': {'communication_strategy': 'Status page updates and email '
                                        'notifications to business users',
              'containment_measures': 'Additional DDoS protection measures to '
                                      'filter malicious traffic upstream',
              'remediation_measures': 'Reducing strain on infrastructure'},
 'stakeholder_advisories': 'Business users of Threema Work were notified via '
                           'email about unstable conditions.',
 'title': 'Threema Hit by Persistent DDoS Attacks, Causing Widespread Service '
          'Disruptions',
 'type': 'DDoS'}