How cyberattackers used a US company in efforts to crash media sites

The cyberattack against the Somali Journalists Syndicate could not have come at a worse time. A distributed denial-of-service attack, known as DDoS, flooded the local press freedom group’s website with traffic, knocking it offline in early August. Days later, authorities arrested SJS staff member and Kaab TV editor Mohamed Ibrahim Osman Bulbul.

“It was a very traumatic week. Sleepless. Very stressful. We could not publish our statement, the first statement of Mohamed’s detention,” SJS secretary general Abdalle Ahmed Mumin told CPJ’s Jonathan Rozen.

Qurium, a non-profit based in Sweden, began hosting and defending the SJS website. When the next DDoS attack came a week later, Qurium’s analysis found that a U.S. company, RayoByte, had provided services used by the attackers. Quirium also found that tools provided by RayoByte, a Nebraska-headquartered company owned by Sprious group, had been used in several other attacks on media outlets from around the world, including Kosovo, Nigeria, Kyrgyzstan, the Philippines, and Turkmenistan. (Sprious declined CPJ’s requests for an interview but said in emailed statements that it was “deeply concerned” about reports that its services were “allegedly” used in DDoS attacks.)

Read Rozen’s report on the mechanics of these online censorship efforts and what they mean for press freedom.