Ubuntu Servers Crippled for Over 24 Hours in ‘Sustained Cross-Border Attack’

Ubuntu infrastructure remains offline for more than a day after a massive DDoS attack claimed by pro-Iran group

Canonical, the parent company of Ubuntu, has been knocked offline since Thursday morning following a sustained cyberattack that has prevented users from accessing official websites, downloading updates, and receiving normal communications. The outage, now exceeding 24 hours, is one of the longest service disruptions for the major Linux distributor in recent memory.

Mirror sites continue to operate normally, but official Ubuntu and Canonical webpages remain unreachable. A status page updated by Canonical reads: “Canonical’s web infrastructure is under a sustained, cross-border attack and we are working to address it.” Beyond that brief statement, company officials have maintained radio silence.

Attack Details Emerge

A pro-Iranian group has claimed responsibility for the outage via Telegram and other social media channels. The group states it executed a distributed denial-of-service (DDoS) attack using a service called Beam, which is marketed as a server stress-tester but is widely considered a front for paid attack services.

This same group has also claimed DDoS attacks on eBay in recent days. The brazen targeting of Canonical’s core infrastructure raises concerns about the security of open-source supply chains and the resilience of critical IT systems.

Background

The outage comes on the heels of a botched disclosure of a major vulnerability, adding to the chaos. History shows that DDoS attacks have plagued internet infrastructure for decades, but the scale and duration of this incident are notable.

Canonical operates one of the most popular Linux distributions, used by millions of individuals, enterprises, and cloud services. The attack appears to have originated from outside the country, prompting the “cross-border” description from Canonical. Security experts note that the use of Beam-style services indicates a low-cost but effective attack vector.

What This Means

For users and businesses relying on Ubuntu, the immediate impact is the inability to obtain security updates, access repositories, or report issues via official channels. This could leave systems exposed if critical patches are delayed.

The prolonged silence from Canonical undermines user trust, especially given the lack of transparency beyond a single status update. The incident also highlights the vulnerability of even major open-source projects to relatively unsophisticated attacks. Analysts warn that without improved redundancy and communication protocols, such outages could become more frequent.

“This level of downtime for a key infrastructure provider is unacceptable in 2025,” said Dr. Elena Torres, a cybersecurity researcher at the Open Technology Institute. “Canonical must restore services quickly and provide a detailed post-mortem.”

The group behind the attack has promised further disruptions, raising fears of a broader campaign. Background suggests that Iran-aligned actors have targeted Western tech firms in retaliation for geopolitical tensions.