North Korea Internet Outage, ConnectWise Hack

North Korea’s internet presence went dark for about 32 hours on Oct. 20 and 21, 2026, knocking roughly 42 official .kp websites offline, as Microsoft separately tied a major supply-chain cyberattack on IT services firm ConnectWise to a China-state-aligned hacking group. No government or researcher has attributed the North Korea outage to a cyberattack.

Scope note: this report separates what was measured or officially stated from what remains a claim or a theory. The PHP software flaw that pushed governments to take their own websites offline the same day is covered in our earlier report on the PHP vulnerabilities and the emergency patch.

North Korea internet outage: what the measurements show

According to Yonhap News Agency, 42 major sites on North Korea’s .kp country domain became unreachable at about 11 a.m. Pyongyang time on Oct. 20 (10 p.m. Eastern on Oct. 19). They included the Foreign Ministry, the Korean Central News Agency (KCNA), the Rodong Sinmun and Minju Choson newspapers, and the Naenara portal. That first outage lasted about eight hours. Service briefly returned, then failed again around 11 p.m. Pyongyang time.

On Oct. 21, Yonhap counted only 11 moments of normal access, each lasting roughly one to 18 minutes. Sites dropped every one to two minutes even when they loaded. South Korean security analysts cited by Yonhap examined public routing data and the domain name system. The top-level .kp name servers kept answering, but the lower-level name servers for individual sites did not.

Network monitoring service Telecom Observer detected nearly six hours of disruption in North Korea’s Border Gateway Protocol (BGP) routing from 18:10 to 23:50 GMT on Oct. 20, Reuters reported. BGP is the system networks use to announce how traffic reaches them, so a disruption there can make an entire country’s address space unreachable.

SBS reported that the sites stayed stable from about 7 p.m. Pyongyang time on Oct. 21 (6 a.m. Eastern) through at least 5:30 p.m. on Oct. 22. The broadcaster put the total disruption at about 32 hours.

Timeline chart of the North Korea internet outage on Oct. 20-21, 2026, showing reported website and BGP routing disruption windows in UTC — Reported outage windows, in UTC. Website windows are from Yonhap and SBS; the routing window is from Telecom Observer via Reuters. Chart: The Boston Report.

Who caused it? No attribution

The cause had not been confirmed as of Oct. 22. North Korean authorities had not published anything about the outage, Yonhap reported. A South Korean official said there was “no information at this time to confirm whether it is a cyberattack,” according to Yonhap. A Ministry of Unification official told SBS that North Korean sites going down for about two days “often” happens.

Analysts described two possibilities, and neither has been confirmed:

Infrastructure failure. Park Chan-am, CEO of the South Korean security firm Stealien, told Yonhap that North Korea’s unstable power supply can switch border routers and other equipment off and on, which would produce this kind of pattern. He said an outage in June 2025 was assessed as an internal problem rather than an external attack. North Korean servers reach the world through a single Chinese telecom line, so one fault can take many sites down at once, according to experts quoted by Yonhap. Korea JoongAng Daily linked the outage to the Ryugyong-dong network, which depends on China Unicom access via Hong Kong-based Cenbong addresses.
A DDoS attack. Other experts told Yonhap that a distributed denial-of-service attack aimed at that single line cannot be ruled out, because attackers who pause and restart to avoid detection can cause repeated drops. No group has claimed such an attack, and no evidence of one has been published.

The outage overlapped with unfounded rumors on overseas social media that Kim Jong Un had died. Korea JoongAng Daily reported no evidence that the rumor and the outage were linked, and noted that the failure hit nearly every North Korean site, not only news outlets. Kim appeared in state TV footage aired Oct. 20 Unverified claim, Korean Central Television (North Korean state media), which showed him at a Pyongyang exhibition on Oct. 19.

ConnectWise attack: the major breach Microsoft tied to China

On Oct. 21, Microsoft said a hacking group it tracks as Storm-0940 was responsible for the supply-chain compromise of ConnectWise Cloud Backup. Microsoft describes the group as China-state-aligned and active since 2021. According to Microsoft, the group began using ARTEX, an open-source AI penetration-testing framework, as early as September 2026 to automate attacks on hundreds of organizations. In several cases it went from first targeting to privileged cloud access in under three hours.

The attackers used ConnectWise applications that customers had already authorized to sign in to their Microsoft 365 environments. That let them work without an interactive user login. Microsoft said it saw reconnaissance, application credential changes and attempts to raise privileges through Microsoft Graph. Microsoft also said its own systems were not compromised, and that a successful sign-in does not necessarily mean customer data was taken.

Targets spanned aerospace, defense, energy, finance, government, media, semiconductors, think tanks and nonprofits, Reuters reported. Most attempts failed, Microsoft said, but the group gained persistent privileged access at many organizations. ConnectWise CEO Manny Rivelo said the company contained the affected application connections and is restoring service in phases. He added that access attackers may already have set up inside customer tenants requires separate review.

ConnectWise’s remediation guide says it disabled seven application identities and revoked their credentials. A Chinese Embassy spokesperson in Washington said China “opposes and fights hacking activities” and opposes “smears and attacks against China under the excuse of cybersecurity issues.”

Other cyber developments on Oct. 21

CISA, the FBI, the Secret Service and international partners issued a joint advisory on SafePay ransomware. It links the group to about 600 victims across the Americas, Europe and Australia.
Government agencies in the Netherlands and Finland, the UK’s Edinburgh council and parts of Wikipedia took systems offline as a precaution over the PHP flaws, according to the BBC.
Huntress published separate findings on abuse of ConnectWise (SkyKick) vendor credentials in Microsoft 365 attacks.
For more North Korea coverage, see our reports on the new Yalu River bridge to China and the AI torpedo test.

Featured image: Pyongyang at night, by 東京のエビフライ, via Wikimedia Commons, CC BY-SA 3.0. Cropped.

Sources

Like this story? Get the newsletter

The day's Boston news, weather and local business in one short email, with links to the full stories.

Latest

All latest news →

North Korea’s Internet Goes Dark for 32 Hours as Microsoft Ties ConnectWise Hack to China-Aligned Group