Multiple distributed denial-of-service (DDoS) attacks targeted the Threema secure messaging service earlier this week, causing severe disruptions to communications.
Organizations using Threema On-Prem did not experience any issues because they rely on their own infrastructure.
In a post-mortem report on Friday, the end-to-end encrypted instant messaging service said that the attacks were difficult to defend against because the threat actor constantly changed patterns.
Threema is a paid messaging application developed by the Swiss technology company of the same name, with a heavy focus on security and privacy.
The service relies on its own server infrastructure in various locations in Switzerland and promises “no ads, no profiling, no hidden data analyses.”
On Tuesday around 6 PM UTC, users started to report service interruptions. The company responded about an hour later, saying that based on the information available at the time, the cause was “a network outage on our colocation partner’s side.”
“Now Threema network status saying ‘Connecting’ instead of ‘Connected,’ welp… 10mins later, now it’s back to saying ‘Connected,’ yet msgs are still very much not sending right away & very delayed,” one user complained.
About three hours later, Threema said it was working to restore all of its services after its partner reported that the network issue had been resolved.
The next day, users in Switzerland, India, and China continued to report that the service was down, despite Threema’s status page showing no problems.
However, the company confirmed that it was being targeted by a series of DDoS attacks it was working to mitigate, and warned users that intermittent outages were likely to occur.
Threema explains that the attacks made its service “temporarily unavailable or only partially available on Tuesday evening and Wednesday morning.”
Typically, DDoS attacks are mitigated without any noticeable impact due to effective defenses that adapt to the attack’s patterns, Threema said.
The attacks this week were large-scale, though, and targeted both Threema and its colocation partner, Nine.
“It is not entirely clear whether Threema was the primary target or whether the attacks were directed at multiple targets,” the company notes.
Defending against the attacks proved challenging because they persisted for an extended period, while the threat actor continually changed its tactics to circumvent mitigation measures.
An unrelated technical issue prevented the company from updating the current system status page, and the company decided to take it offline until the problem was fixed.
“Business customers using Threema Work were informed via email on Wednesday morning about the unstable service conditions, and account managers provided information on the current situation in response to inquiries.”
To avoid similar incidents, the Swiss company has implemented “specialized DDoS protection as an additional measure” to filter attack traffic upstream and reduce the load on its infrastructure.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
New Evooo1Bot Linux botnet turns routers into traffic relay nodes
DDoS attacks over 1 Tbps surged fivefold in the second quarter
Hackers breached a small Polish energy plant via private APN last year
North Carolina Ports confirms cyberattack disrupting operations
New Dysphoria DDoS botnet spreads to 200k devices worldwide
Hackers arrested over €30M bank fraud exploiting service provider flaw
RingCentral data breach exposed info of 1.6 million accounts
Hackers exploit macOS Screen Sharing flaw to deploy Monero miner
91% of AI Apps Appeared in 16 Months. Get Material’s OAuth Risk Report
Stop AI slopsquatting attacks. Secure open source package ingestion before it hits your build.
Overdue a password health-check? Audit your Active Directory for free
Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how.
Overdue a password health-check? Audit your Active Directory for free
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
