Virtually all North Korean websites have been offline for over a day, cutting off the outside world’s access to state-provided information.

Around 11 a.m. KST on Tuesday, multiple websites started facing persistent outages simultaneously, including those of state media outlets such as the Korean Central News Agency (KCNA), Rodong Sinmun and Minju Joson newspapers, and external radio service Voice of Korea. 

The websites of the official information portal Naenara, the Ministry of Foreign Affairs, national airline Air Koryo and the DPRK Portal listing official North Korean websites have also been down since then.

KCNA came back online every now and then on Tuesday, but was offline for 19 out of 24 hours after the initial outage, according to data from the web-monitoring service Pingdom.

The other sites largely remained offline throughout, apart from short bursts of connectivity on Wednesday morning that added up to approximately 10 minutes.

North Korea’s Silibank SMTP email server has also been offline since around 11 a.m. on Tuesday, apart from a five-minute stretch of connectivity on Wednesday morning.

The reasons for the mass outages aren’t immediately apparent, but the disruptions appear linked to issues in North Korea’s “Ryugyong-dong” network, which has historically relied on internet supplied by the Chinese provider China Unicom via IP addresses associated with Hong Kong-based network Cenbong. 

Russian telecommunications company TransTeleCom has also served as an alternate internet service provider since 2017, and both Chinese and Russian services have routed traffic to a secondary Philippines-based network supplementing Ryugyong-dong since 2023.

Despite these alternate routing pathways, internet connectivity has remained at a standstill for over a day.

With the exception of sporadic periods of connectivity starting around 11:30 a.m. on Wednesday, North Korean websites remain offline as of 1 p.m.

POSSIBLE REASONS

For those seeking news of Kim’s visit to a garment and footwear expo, which disproved rumors of his demise, the lack of access to state media sites such as KCNA created extra barriers to information on Tuesday.

However, it is unlikely that North Korean authorities ordered that the websites be taken offline to limit information to the outside world, as KCNA continued transmitting reports by wire.

Another possibility could be that a surge in external traffic may have overloaded North Korean servers. However, this is unlikely as the outage affected virtually all North Korean websites, not just news-related sites.

The DPRK may be carrying out extensive maintenance work on its internet infrastructure, particularly related to internet traffic routes entering from China.

North Korea has been known to take its websites offline for extended periods in the past when overhauling its online presence, though the duration of the latest outages is longer than typical maintenance periods.

The long outage has also led to speculation of an external attack, similar to past disruptions that took down North Korea’s internet.

After North Korean cybercriminals breached Sony Pictures’ networks in 2014, unknown activist hackers took the country’s limited range of websites offline for approximately 10 hours.

In early 2022, American hacker Alejandro Caceres, who went by the pseudonym P4x, disrupted North Korea’s websites and email services with a series of distributed denial-of-service (DDoS) attacks designed to overload servers with traffic.

Caceres said at the time that he carried out the attack in response to North Korea attempts to steal information about software vulnerabilities by targeting security researchers.

However, there is no clear evidence yet to indicate an external attack on North Korea’s internet infrastructure this time, and no reported claims of responsibility for the disruption so far.

Edited by Bryan Betts