Canonical under sustained DDoS attack as Ubuntu 26 releases — Iranian group 313 Team claims responsibility

The meatspace war with Iran has been spilling into cyberspace as well, and the latest casualty is Canonical. The company behind the ever-popular Ubuntu Linux is in a spot of bother, as the majority of its infrastructure is being hit by a Distributed Denial of Service (DDoS) attack. The attack has reportedly been claimed by Iranian ne'er-do-wells 313 Team, also known as the Islamic Cyber Resistance in Iraq. The attackers requested a virtual meeting with the Canonical staff under threat of continued attacks, but there have been no other public developments.

The most obvious result is that Canonical's, er, canonical Ubuntu download and update mirrors worldwide are sluggish or down entirely, as is the main website. The attack extends to Launchpad, the Snap store, Canonical SSO, and other related services. Thankfully, there are no reports of security compromises affecting package repositories or ISO images, so whichever download spot you find should be safe.

Intentionally or not, this attack comes hot on the heels of the release of Ubuntu 26 LTS, dubbed Resolute Raccoon. As its name and even version number imply, this is a release with an extended support window, meaning it'll be the one installed in servers and workstations worldwide.

Article continues below

Much like yours truly found out yesterday, you may find it difficult to get a hold of Ubuntu 26, package updates, or even the handy WSL2 image. The Linux community is large and spread out, though, so any one of the hundreds of the non-Canonical (pun intended) will suffice. You can find one of the mirrors in the list at launchpad.net; if that link fails to load, you can consult the version on the Wayback Machine here. If you have a torrent client handy, here are the links to the desktop x64 release and the live server x64 version.

Some techies hypothesized that this attack could be related to the disastrous Copy Fail vulnerability, to which most distros, including the extant Ubuntu 24, are vulnerable. That premise is a little shaky, as in the grand scheme of things, just stopping people from updating Ubuntu isn't a world-ender, plus power users and competent sysadmins will apply a workaround or just find a mirror regardless.