Taiwanese government sites hit with DDoS attacks ahead of Pelosi's visit

One attack appears to have shut down the president of Taiwan's website Tuesday before Nancy Pelosi's historic visit.

An apparent distributed denial-of-service attack shut down the president of Taiwan’s website for about 20 minutes Tuesday hours before Speaker of the House Nancy Pelosi’s historic visit, a presidential spokesperson said on Facebook.

An “overseas DDoS attack” hit the office about 5:15 p.m. local time, according to a Google translation of the message. Tingting Liu, a journalist with the Taiwan’s TVBS news, reported that the traffic was “200 times that of a normal day.”

A series of other Taiwanese-based websites appeared to also have had intermittent issues Tuesday, including Taiwan’s Ministry of Foreign Affairs and the Taiwan Taoyuan International Airport. Both sites were, at times, inaccessible mid-morning U.S. time. The presidential site was up, but the English version displayed an “OK” and nothing else.

Taiwanese officials and their counterparts in the U.S. have been on heightened alert in anticipation of Pelosi’s visit, which marks the highest-level U.S. official to visit the island in 25 years. The Chinese government views Pelosi’s visit as an escalation of tensions between the U.S. and China, and warned of “disastrous consequences” if the U.S. “mishandles the situation,” The Washington Post reported.

A spokesperson for the U.S. National Security Council did not immediately respond to a request for comment.

DDoS attacks are relatively basic and don’t require sophisticated tooling or the resources of state-backed hackers to pull off. Smaller DDoS attacks are common and typically a nuisance, but larger attacks can cause prolonged issues and inaccessibility.

Doug Madory, the director of internet analysis at network monitoring firm Kentik, told CyberScoop Tuesday that there were noticeable spikes in traffic to websites for the airport and other sites. The attacks were “effective, but not record breaking,” he said. “As far as the core pipes of the Taiwanese internet, everything looks normal.”

Johannes Ullrich, the dean of research at the SANS Institute, said in a blog post Tuesday that the available data about Tuesday’s DDoS activity suggested it wasn’t “huge,” and “something likely within the capabilities of a few hacktivists getting together.”

John Hultquist, the vice president of intelligence analysis at Mandiant, said in a statement that the situation in Taiwan “has already led to cyber threat activity, some of which is apparent, like DDoS attacks on websites in Taiwan.”

Two Chinese information operations Mandiant tracks “have shifted their narratives in recent days” to a focus on Pelosi’s visit, he said, and “[we] anticipate that Chinese actors are also carrying out significant cyber espionage against targets in Taiwan and the U.S. to provide intelligence on the crisis.”

Officials seize 53 DDoS-for-hire domains in ongoing crackdown

Operation PowerOFF’s latest globally coordinated action identified more than 75,000 alleged cybercriminals. Officials warned each of them to stop jamming up traffic.

Officials gain control of Rapper Bot DDoS botnet, charge lead developer and administrator

Pro-Russian DDoS group NoName057(16) disrupted by international law enforcement operation

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure