International

Cyberattackers used US company RayoByte in efforts to crash media sites

Published

3 years ago

September 9, 2023

THE cyberattack against the Somali Journalists Syndicate could not have come at a worse time. A distributed denial-of-service attack known by its acronym DDoS, flooded the local press freedom group’s website with traffic in early August and knocked it offline.

Days later, authorities arrested SJS staff member and Kaab TV editor Mohamed Ibrahim Osman Bulbul in connection with his reporting on alleged corruption. The tandem crises placed major strain on the organization.

“It was a very traumatic week. Sleepless. Very stressful. We could not publish our statement, the first statement of Mohamed’s detention,” SJS secretary general Abdalle Ahmed Mumin told CPJ in an interview from the U.K., where he fled earlier this year after he was repeatedly arrested by Somali authorities. “Imagine someone attacking your team, detaining one of your team, and you’re not able to communicate to the international world because your website has been taken down.”

SJS found some relief when it connected with Qurium, a Sweden-based nonprofit that began hosting SJS’s website. But a week after the initial attack, another DDoS flood hit the website. This time, Qurium was able to protect SJS from going offline. Qurium’s analysis of these additional attacks also found that a U.S. company, RayoByte, had provided the tools used in the attack.

Sprious, which owns RayoByte, told Qurium in an email, which CPJ reviewed, that it had “removed the abusive user” from its network and added the SJS site to its “blacklist” to prevent it from being targeted further.

SJS isn’t the only news outlet that has suffered a DDoS attack using RayoByte’s services. News outlets from at least five other countries — Kosovo, Nigeria, Kyrgyzstan, the Philippines, and Turkmenistan — have faced similar attacks over the last two years, according to Qurium’s analysis. These incidents provide a rare look at the mechanics of online censorship efforts and how private corporations can profit from them.

READ ALSO:

Sprious declined CPJ’s requests for an interview and did not directly answer a list of written questions. But in emailed statements to CPJ, Sprious said it was “deeply concerned” about reports that its services were “allegedly” used in DDoS attacks. “We firmly stand against any form of online harassment or harm, including cyber-attacks, especially when it concerns entities that play a crucial role in promoting press freedom and the safety of journalists,” it said.

Headquartered in Lincoln, Nebraska, Rayobyte, formerly known as Blazing SEO, is one of many companies that sells clients access to Internet Protocol (IP) addresses, unique numbers assigned to internet-connected devices, for “scraping,” a method for extracting large amounts of data from websites. RayoByte’s website lists a range of prices for access to IP addresses based on variables including type and speed.

One way to conduct scraping is through repeated requests to visit a site with different IP addresses. Journalists and researchers use scraping as a reasearch technique, but when IP requests are directed quickly and en masse toward a specific site in order to overwhelm it and knock it offline, this constitutes a DDoS attack.

CPJ has documented DDoS attacks against outlets conducting critical journalism around the world. These cyberattacks also often take place alongside other threats to journalists’ safety and press freedom.

Qurium’s analysis shows that it blocked nearly 20,000 IP addresses from hitting the SJS website with millions of requests on August 18 and 19. The largest portion of the traffic (nearly 50%) came via RayoByte and its hosting partners, the analysis said. The second half of the traffic came through several other online channels, including virtual private networks (VPNs).

“We were very effective at mitigating the attack because within a few hours we realized we had seen this type of traffic before,” Qurium’s Lundström told CPJ. “We have met this [attacking] infrastructure in the past…this infrastructure is no joke.”

Similar DDoS attacks began almost immediately after Kosovo-based news site Nacionale began publishing in March 2022, covering local politics and social issues, co-founder Visar Arifaj told CPJ in a recent phone interview. “Our website would be down quite often. Because we were still fresh in the news market, it really had an impact for us to reach our audiences,” Arifaj said. “For us to be down a couple of hours during the day was a huge blow.”

Qurium began hosting and defending Nacionale in September 2022, and in March and April 2023 Qurium notified Sprious that attackers had been using its services against the outlet.

READ ALSO:

In emails from March, Qurium informed Sprious of attacks lasting “several hours non-stop.” One of the attacks “sourced” millions of web requests from IP addresses “publicly advertised by Rayobyte/BlazingSEO,” Qurium said. Sprious responded that it had “blacklisted” access to Nacionale’s website and it had barred the “user” responsible – which Sprious did not name — from accessing its services, but in April Qurium again tracked a DDoS attack against Nacionale involving RayoByte. In response to Qurium’s email about the April attack, Sprious said it had “discovered an issue” with its “security controls,” and had addressed it “to prevent further traffic.”

However, RayoByte-sourced internet traffic to Nacionale’s website did not stop and featured in DDoS attacks against the outlet in July and August, Lundström told CPJ. While Kosovo police arrested and prosecuted one man in connection with the cyberattacks and Qurium has successfully prevented the continued attacks from taking Nacionale offline, Lundström told CPJ that incoming traffic shows attackers continuing to harness IPs from a combination of proxy services, VPNs, and other sources.

Alongside the cyberattacks, Nacionale’s staff have been subjected to “constant” online harassment for their work and were recently physically attacked on the job, though those attackers have been arrested, Arifaj told CPJ. “This constant pressure, even when it doesn’t get to the journalists physically and in a direct manner, you can see that it does a lot for their burnout,” he added. “It does take a toll, mentally, on everyone.”

Since 2022, Qurium has additionally tracked DDoS attacks with IPs sourced from RayoByte against four other outlets: Peoples Gazette from Nigeria, Kloop from Kyrgyzstan, Bulatlat from the Philippines, and Turkmen.news, which reports on Turkmenistan from exile. The attacks on three of the four outlets, excluding Kloop, also involved traffic via VPNs.

In its statements to CPJ, Sprious said it investigates reports of DDoS attacks using its services and takes “appropriate actions with the end user that we believe is responsible” and “steps to mitigate the reported issues, including, but not limited to, blacklisting associated domains and working diligently to remove abusive users.”

The statements did not respond directly to CPJ’s requests for details of the customers responsible for these attacks and how the company responded in each case.

Lundström told CPJ that Sprious has yet to respond to Qurium’s emails concerning the attacks on Peoples Gazette, Kloop, Bulatlat, and Turkmen.news, as well as the additional attacks on Nacionale in July and August.

Proxies and VPNs have valid and important uses for ensuring internet users, including journalists, can maintain privacy online. Rights organizations, including CPJ, recommend the use of VPNs to defend against surveillance; individuals can use it to avoid state-backed online censorship, and companies use them to safeguard proprietary information. But Lundström described the use of proxy and VPN services to conduct DDoS attacks as a “weaponization” of these tools. “You’re hiding in a tool [made] for another purpose,” he said of the attackers. “I think it’s a strategic decision.”

READ ALSO:

“DDoS attacks are illegal under a section of the [U.S.] Computer Fraud and Abuse Act,” Gabe Rottman, director of the Technology and Press Freedom Project at the U.S.-based Reporters Committee for Freedom of the Press, which provides legal support to journalists, told CPJ. But he said that it is not necessarily illegal for proxy or VPN companies’ to provide services that are then used in DDoS attacks.

That doesn’t mean service providers can’t take actions. “You can have technology providers doing appropriate things to protect their users and others at the same time as they build their service in a way that protects privacy,” Rottman said. “If … you become aware of bad actors doing bad things, notify the authorities, stop them from using your service, mitigate the damage.”

Attacks on the SJS website have continued, Lundström told CPJ, though none of the IPs have come via RayoByte since Qurium and CPJ contacted Sprious for comment. Nevertheless, Lundström wants RayoByte’s leadership to do more to address the fact that attackers have repeatedly come to the company’s services to target media sites. “[RayoByte’s] making all the money,” he said. “And we have to do all this extra work and build new infrastructure to deal with all this shit.”

As for SJS, Abdalle remains worried about his colleague, who is still behind bars. But he says he’s confident that the press freedom group’s website will remain accessible.

He still doesn’t know the identity of the person or people who launched the cyberattack, but he imagines what they might be thinking: “Now they are witnessing, they are coming into a new reality that even after the attack SJS is still resilient. SJS is still active. SJS is still available and is able to work and operate effectively both online and physically inside Somalia.”

Jonathan Rozen is CPJ’s senior Africa researcher. Previously, he worked in South Africa, Mozambique, and Canada with the Institute for Security Studies, assessing Mozambican peace-building processes. He also wrote analyses for the think tank adelphi on links between climate action and conflict prevention. Rozen was a U.N. correspondent for IPS News and has written for Al-Jazeera English and the International Peace Institute.

Cyberattackers used US company RayoByte in efforts to crash media sites

Related Topics:Cyberattackers media sites US

Up Next

Niger military accuses France of deploying forces with view to ‘intervention’

Don't Miss

Detained ex-Gabon President Ali Bongo released for overseas medical treatment

International

Trump Warns Iran: Open Hormuz or Get ‘Hit Very Hard’ as 48-Hour Deadline Looms

Published

13 hours ago

August 5, 2026

Trends Admin

Trump Warns Iran: Open Hormuz or Get ‘Hit Very Hard’ as 48-Hour Deadline Looms

United States President Donald Trump has warned Iran it will be “hit very hard” unless the Strait of Hormuz is reopened “very soon,” while insisting that talks between the two sides were ongoing despite Tehran flatly denying any direct negotiations were taking place. Speaking in an interview with Fox News on Tuesday during a visit to California, Trump said he preferred a diplomatic resolution but left no doubt about the consequences of failure. “The strait is going to be open very soon, or they are going to get hit very hard, and then the strait’s going to be open,” he said. “If they back out again, they are going to get hit really hard. They know that. They understand that. I have no choice.” The president also described the planned military operation as extensive and still on the table despite his decision to pause it over the weekend. “It’s very tough to do what we have planned, still planned. We’ll see what happens,” he said, adding that he was “very proud” of giving Iran a chance to negotiate before launching what he suggested would be a large-scale assault. “We hit them very, very hard. But the hard hit is yet to come, and hopefully we won’t have to use it.” Trump simultaneously accused Iran of duplicity for publicly denying it was in talks with Washington. In a post on Truth Social, he wrote: “Iranian Leadership is unbelievably duplicitous! They ask for a meeting, some would say ‘beg,’ talks begin, with more scheduled in the immediate future, and they say, openly and proudly, that they’re not having any discussions, that nothing is being talked about, and they’re only dealing with ‘Oman’.” He added that “nothing gets through to Iran, unless we want it to, and nothing will get through, unless a Deal, or Total Surrender, is accomplished.”

Iran’s Foreign Ministry flatly rejected Trump’s characterisation. Spokesperson Esmaeil Baghaei said Tehran was not holding direct discussions with the United States and was only engaged in talks with Oman regarding a temporary safe route through the strait. “Discussions are currently focused on a possible navigation corridor for two-way vessel traffic. That initiative is unrelated to negotiations on fully reopening the strait. It is a separate issue,” Baghaei said. Baghaei added that all Iranian negotiators were currently in the country, with Foreign Minister Abbas Araghchi on a religious pilgrimage in Iraq and unavailable for negotiations at least until the end of the week. The only exception, he said, was the ongoing bilateral discussions with Oman as the two coastal states responsible for the waterway.

READ ALSO:

According to Axios, which cited unnamed regional and US officials, the United States, Iran, and Oman are nearing an interim agreement to reopen the Strait of Hormuz, with Washington hoping to announce the deal as early as Wednesday. The proposed arrangement would be a 60-day agreement for safe passage in the strait between Iran and Oman, with negotiators working on final details. Under the reported framework, ships entering the Persian Gulf would travel north through Iranian territorial waters, while outbound vessels would travel south through Omani waters in coordination with Tehran. The agreement would not involve the collection of transit fees or tolls, and the parties would clear mines from the central shipping lane within 30 days. A US official and one regional source told Axios that Iranian leadership had completed the approval process for the agreement on Tuesday. While US Secretary of State Marco Rubio confirmed that progress had been made in discussions with Iran, he noted that talks had not yet been finalized but that the White House was “hoping” for an agreement “in the very near future.”

Iran’s senior officials have taken a defiant stance, warning the United States against any adventurous actions. The Iranian Foreign Ministry reiterated that Tehran views Hormuz as a crucial source of strategic leverage that it cannot afford to surrender, while Washington insists that Iran must not be allowed to control an international waterway. Iran continues to insist that any agreement must leave it in control of the Strait of Hormuz. Regional officials told The Associated Press that any agreement to reopen Hormuz would also require the removal of the current US blockade on Iranian ports. Meanwhile, Iranian military sources have denied Trump’s claim that Tehran asked Washington to call off its strikes, calling his remarks “a new lie,” according to Iran’s semi-official Mehr news agency.

The diplomatic confusion was underscored when another cargo vessel was attacked near the strait’s Omani coast on Tuesday. The United Kingdom Maritime Trade Operations Centre (UKMTO) reported receiving multiple reports that a tanker had been struck by an unknown projectile approximately eight nautical miles east of Oman’s Limah. The tanker’s crew abandoned the vessel and boarded a lifeboat, with the vessel’s main engine disabled and a bunker tank on fire. The UKMTO did not identify the ship or its owner, and authorities are investigating. Separately, Iran’s Revolutionary Guards said on Tuesday that two oil tankers had caught fire after explosions while attempting to transit the southern route of the strait, though Reuters could not independently verify the Guards’ statement.

The disruption of the Strait of Hormuz has sent oil prices soaring and placed heavy pressure on Trump to stop the fighting, partly because of the effect rising energy prices could have on American voters ahead of the November congressional midterm elections. Treasury Secretary Scott Bessent had earlier told CNBC that a deal to reopen the strait could come as early as Tuesday or Wednesday, saying there were “hundreds if not 1,000 ships sitting in there waiting to go out,” including tankers carrying oil, fertiliser, refined products and industrial gases. Trump has vowed that Iran will not be permitted to collect transit fees in the strait, declaring, “If anyone is allowed to collect fees, it will be us. We have complete control.” The president had previously said he expected to know by Tuesday how the talks were going, “one way or the other,” but insisted that the path forward is clear. As the 48-hour window unfolds, the world watches to see whether the negotiations will yield a breakthrough or whether Trump will follow through on his threat to unleash a devastating military campaign. “If they don’t make a deal, it’s going to be too bad. And we have much more on Iran coming up,” Trump said. All parties remain on high alert, with the potential for a catastrophic escalation in West Asia now greater than at any point since the conflict began.

Trump Warns Iran: Open Hormuz or Get ‘Hit Very Hard’ as 48-Hour Deadline Looms

International

Iran Denies US Talks After Trump Announces Negotiations as War Enters Sixth Month

Published

2 days ago

August 3, 2026

Trends Admin

Iran Denies US Talks After Trump Announces Negotiations as War Enters Sixth Month

Tehran rejects Washington’s claim of imminent talks, says discussions with Oman over Strait of Hormuz are separate and ongoing

Iran has firmly denied that it is currently holding negotiations with the United States, contradicting President Donald Trump’s announcement that talks would begin on Monday afternoon. The conflicting claims come amid heightened tensions over the Strait of Hormuz and Iran’s nuclear program, with the war between the two countries now in its sixth month. The war began on February 28, 2026, when the United States and Israel launched surprise strikes against Iran, targeting key leadership, air defence capabilities, missile sites, and the Islamic Revolutionary Guard Corps (IRGC) Navy. The opening salvo included an attack on a leadership meeting in Tehran that killed Supreme Leader Sayyid Ali Khamenei, Iran’s defence minister, the chief of staff of the armed forces, and the commander of the IRGC. Since then, months of on-off diplomacy have led to periods of relative calm, though fighting has continued to flare.

Iranian Foreign Ministry spokesman Esmaeil Baqaei stated during a televised press conference on Monday that “Iran is not currently holding talks with the United States”. He elaborated that Tehran has no plans to host or send delegations, and members of Iran’s negotiating delegation remain inside the country. Baqaei clarified that Iran’s current discussions are focused exclusively on Oman regarding a temporary safe route through the Strait of Hormuz. He emphasized that reaching an agreement with Oman would not mean the reopening of the strait, as the situation would remain unchanged while US “aggression” continued. “So long as the United States continues to violate its commitments, the situation in the Strait of Hormuz will not change,” Baqaei told his weekly press conference. The spokesman also warned Gulf states against allowing the United States to use their territory for attacks on Iran, urging countries in the region not to facilitate US military action.

READ ALSO:

On Sunday, President Trump told reporters aboard Air Force One that negotiations with Iran would begin Monday afternoon. He claimed that the talks would cover the Strait of Hormuz and ultimately the denuclearisation of Iran. “The deal is imminent, having to do with the Hormuz Strait and also, ultimately, the denuclearization of Iran,” Trump said. Trump stated that he had been asked by Iran as well as US partners Saudi Arabia, the United Arab Emirates, and Qatar to hold off on strikes, which he claimed would have been “the biggest attack since World War II”. In a post on Truth Social, Trump wrote: “Based on this request, I have agreed, for the future benefit of the WORLD and, likewise, the survival of a successful and prosperous Iran, to cancel the attack, subject to being able to rapidly make a DEAL”. However, Iranian media has denied that Tehran asked Trump not to strike. Trump has repeatedly predicted that a negotiated settlement is within reach, although previous diplomatic efforts have been followed by renewed exchanges of military strikes.

While denying US talks, Iranian officials confirmed progress in discussions with Oman over a new shipping route through the Strait of Hormuz. Iranian Foreign Minister Abbas Araghchi said negotiations with Oman on a mechanism for ships to transit the waterway were “nearing completion and in their final stages,” according to Iranian state media. The talks have been ongoing for months between Tehran and Muscat, the two littoral states bordering the strait, with discussions continuing at both the technical and political levels. Baqaei told state television that a deal was close with Oman over a new route through the strait, describing it as “one path with entry and exit lanes” that would respect the sovereign rights of both sides. The route under discussion will be temporary, he said, and through it, Iran will ensure safe navigation. Baqaei emphasized that Iran and Oman, as coastal states of the strait, are required to cooperate to ensure the safe passage of vessels through the waterway and reach a defined mechanism. He noted that Tehran needs to ensure that the Strait of Hormuz would not be exploited by the parties that have carried out aggression against Iran, adding that “this requires us to adopt a mechanism in which Iran’s sovereign rights are fully respected”.

The conflicting claims come against the backdrop of a war that has significantly disrupted global energy markets. Before the war, the Strait of Hormuz served as a conduit for approximately 20% of the world’s oil and liquefied natural gas. Iran has largely closed the strait, causing energy prices to rise and stoking broader inflation. On June 18, Iran and the United States signed a memorandum of understanding (MoU) on ending the conflict, under which the two countries were scheduled to hold negotiations within a 60-day period to reach a final agreement. Under the understanding, Iran agreed to allow fee-free maritime transit through the Strait of Hormuz for a period of 60 days. However, the talks’ fate has been uncertain due to recent military escalation. The US attempted to undermine Iran’s sovereignty by establishing an unsafe corridor near Omani shores, prompting Iran’s firm response to re-impose restrictions on the strait.

Iranian President Masoud Pezeshkian posted on X that “We must strive to compel the enemy to remain committed to what it has signed”. He expressed belief that the MoU would be the focal point of Iran’s foreign relations in the future. Baqaei also revealed that over the past 24 hours, “we have received numerous calls from the United Kingdom, Bulgaria, and Ukraine stating that they will not be part of the war against Iran”. Iranian lawmaker Hassan Ghashghavi, spokesman for the parliament’s national security commission, said on Sunday that mediators were trying to revive the US-Iran memorandum of understanding that was agreed in June. That agreement was not intended as a final peace deal, but as a stepping stone to negotiations on a comprehensive agreement, though it did include provisions on Hormuz. “They know that the main issue and, in fact, the key to the matter right now is the issue of the Strait of Hormuz, so yes, there is an exchange of views,” Ghashghavi said.

Trump’s announcement had immediate market effects, with oil prices falling at the opening of Asian trade. The president said he had been asked by Iran as well as US partners Saudi Arabia, the United Arab Emirates, and Qatar to hold off on further strikes. Eli Cohen, Israel’s energy minister and a member of Prime Minister Benjamin Netanyahu’s security cabinet, said there was close security and intelligence coordination between Israel and the US on everything happening in the region. However, he added: “With or without an agreement, and regardless of any external commitments, if Iran attempts to renew its nuclear programme or advance its ballistic missile industries, we will be there. We will take action, and we will strike”. In his call with Trump, Saudi Crown Prince Mohammed bin Salman stressed the “necessity of prioritising dialogue to de-escalate tensions” in the Middle East, according to Saudi Arabia’s state news agency. Many observers have expressed skepticism about the latest diplomatic push. Vali Nasr, an Iran expert at Johns Hopkins University, stated there was “no clear path” for Trump to achieve his goals, noting that “He is trying his hand now at a diplomatic solution to avoid military escalation. But there’s no clear path, either diplomatically or militarily, to get Trump to a place where he can declare victory”.

Iran Denies US Talks After Trump Announces Negotiations as War Enters Sixth Month

Additional reporting by Reuters, AFP, Ynetnews, and The New Arab

International

Oil Prices Slide as Trump Announces Fresh Iran Talks, Easing Supply Fears

Published

3 days ago

August 3, 2026

Trends Admin

Oil Prices Slide as Trump Announces Fresh Iran Talks, Easing Supply Fears

Global oil prices fell sharply in early Asian trading on Monday after United States President Donald Trump announced fresh negotiations with Iran, raising hopes of easing tensions in the Middle East and restoring normal shipping through the strategically vital Strait of Hormuz.

Brent crude, the international oil benchmark for September delivery, dropped 4.69 per cent to $83.81 a barrel as of 2250 GMT on Sunday, while the US benchmark, West Texas Intermediate (WTI), declined 4.67 per cent to $80.72.

The decline followed Trump’s announcement on Sunday that Washington would resume diplomatic engagement with Tehran instead of pressing ahead with major military strikes against the Islamic Republic.

READ ALSO:

“Now what we’re doing is we’re talking to them in the form of a negotiation. It begins tomorrow afternoon,” Trump said, without disclosing the venue or those expected to participate in the talks.

Oil markets have remained highly volatile since the conflict between the United States, Israel and Iran escalated in late February, disrupting traffic through the Strait of Hormuz—a critical maritime corridor for global crude oil and liquefied natural gas exports.

The renewed diplomatic push has fuelled optimism that the waterway could soon reopen fully, reducing the risk of prolonged disruptions to global energy supplies.

Adding to the positive sentiment, Iran said on Sunday that it was close to reaching an agreement with Oman on establishing a new shipping arrangement through the Strait of Hormuz, a development that could further stabilise oil exports from the region.