Threema Messenger Hit by Large-Scale DDoS Attack

The secure messaging app Threema fell victim this week to a series of distributed denial-of-service (DDoS) attacks that left the service temporarily unavailable or only partially operational. The Swiss company disclosed this in a report published on Friday.

Threema is a paid, security- and privacy-focused app developed by the eponymous Swiss firm. The service runs on its own server infrastructure located at various sites across Switzerland, and it promises users no ads, no profiling, and no covert data analysis.

How the outage unfolded

The first complaints about disruptions surfaced on Tuesday around 18:00 UTC. About an hour later, the company suggested the cause was a network fault on the side of its colocation partner. A few hours after that, Threema reported that it was restoring services once the partner had confirmed the issue had been resolved.

The next day, however, users in Switzerland, India, and China continued to report that the messenger was unreachable, even though Threema's status page showed no problems. The company later confirmed that it was under a series of DDoS attacks and was trying to fend them off, warning of likely intermittent outages.

Why the defenses fell short

DDoS attacks are usually deflected without users noticing, thanks to mechanisms that adapt to the nature of the assault. This time, however, the attacks were large-scale and struck both Threema and its colocation partner, the company Nine, at the same time. Threema itself would not say for certain whether it was the primary target or whether the blow landed on several targets at once.

Repelling the assault proved difficult: the attacks went on for a long time, and the perpetrator kept changing tactics to bypass the defensive measures. On top of that, a separate technical glitch prevented the company from updating its status page, which had to be taken offline temporarily. Business customers on the Threema Work plan were warned of the instability by email on Wednesday morning.

Notably, organizations using the Threema On-Prem variant experienced no disruptions — they rely on their own infrastructure.

To prevent a recurrence of the incident, the company has deployed specialized DDoS protection: it filters out malicious traffic upstream and eases the load on the infrastructure.

Source: Bleeping Computer