On October 21, 2016, attackers launched three consecutive distributed-denial-of-service attacks against Dyn, a major Domain Name System provider. Because DNS translates web addresses into IP addresses, the assault made services including major internet platforms unavailable to large numbers of users across Europe and North America. Dyn said it received malicious requests from tens of millions of IP addresses, overwhelming its infrastructure. Investigators linked the traffic to Mirai malware infecting poorly secured internet-connected devices, including cameras, printers, residential gateways, and baby monitors.
The perpetrators were not immediately identified. Anonymous, New World Hackers, SpainSquad, and others claimed responsibility, including an alleged retaliation for Ecuador restricting Julian Assange’s internet access, but those claims remained unconfirmed; President Barack Obama said on October 25, 2016, that investigators did not know who was behind the attack. Mirai’s source code had been publicly released weeks earlier, complicating attribution. On December 13, 2017, the U.S. Justice Department announced guilty pleas by Paras Jha, Josiah White, and Dalton Norman in cases involving Mirai and click-fraud botnets. On December 9, 2020, an additional perpetrator pleaded guilty to participating in the Dyn attack, but authorities withheld the person’s name because of their age. The incident exposed the systemic security risks of unmanaged IoT devices and the fragility of centralized internet infrastructure.
