Threema, the Swiss encrypted messaging service, was hit by a series of large-scale distributed denial-of-service (DDoS) attacks on Tuesday and Wednesday this week, disrupting communications for thousands of users. The attacks targeted both Threema’s own servers and the company’s colocation partner, Nine, making it unclear whether Threema was the primary target or one of multiple victims.
Users in Switzerland, India, and China reported the service was unreachable or severely delayed even as Threema’s status page showed no problems — the company later explained that an unrelated technical issue prevented it from updating the status page, leading it to take the page offline. In its post-mortem report, Threema said the attacks were unusually persistent and that the threat actor “constantly changed its tactics” to get around mitigation measures, making the attacks harder than usual to beat. Organizations running Threema On-Prem — the self-hosted version — were not affected, since they operate their own infrastructure. As a precaution, Threema has now added specialized upstream DDoS filtering to help block future attacks before they reach its servers.