International

Cyberattackers used US company RayoByte in efforts to crash media sites

Published

3 years ago

September 9, 2023

THE cyberattack against the Somali Journalists Syndicate could not have come at a worse time. A distributed denial-of-service attack known by its acronym DDoS, flooded the local press freedom group’s website with traffic in early August and knocked it offline.

Days later, authorities arrested SJS staff member and Kaab TV editor Mohamed Ibrahim Osman Bulbul in connection with his reporting on alleged corruption. The tandem crises placed major strain on the organization.

“It was a very traumatic week. Sleepless. Very stressful. We could not publish our statement, the first statement of Mohamed’s detention,” SJS secretary general Abdalle Ahmed Mumin told CPJ in an interview from the U.K., where he fled earlier this year after he was repeatedly arrested by Somali authorities. “Imagine someone attacking your team, detaining one of your team, and you’re not able to communicate to the international world because your website has been taken down.”

SJS found some relief when it connected with Qurium, a Sweden-based nonprofit that began hosting SJS’s website. But a week after the initial attack, another DDoS flood hit the website. This time, Qurium was able to protect SJS from going offline. Qurium’s analysis of these additional attacks also found that a U.S. company, RayoByte, had provided the tools used in the attack.

Sprious, which owns RayoByte, told Qurium in an email, which CPJ reviewed, that it had “removed the abusive user” from its network and added the SJS site to its “blacklist” to prevent it from being targeted further.

SJS isn’t the only news outlet that has suffered a DDoS attack using RayoByte’s services. News outlets from at least five other countries — Kosovo, Nigeria, Kyrgyzstan, the Philippines, and Turkmenistan — have faced similar attacks over the last two years, according to Qurium’s analysis. These incidents provide a rare look at the mechanics of online censorship efforts and how private corporations can profit from them.

READ ALSO:

Sprious declined CPJ’s requests for an interview and did not directly answer a list of written questions. But in emailed statements to CPJ, Sprious said it was “deeply concerned” about reports that its services were “allegedly” used in DDoS attacks. “We firmly stand against any form of online harassment or harm, including cyber-attacks, especially when it concerns entities that play a crucial role in promoting press freedom and the safety of journalists,” it said.

Headquartered in Lincoln, Nebraska, Rayobyte, formerly known as Blazing SEO, is one of many companies that sells clients access to Internet Protocol (IP) addresses, unique numbers assigned to internet-connected devices, for “scraping,” a method for extracting large amounts of data from websites. RayoByte’s website lists a range of prices for access to IP addresses based on variables including type and speed.

One way to conduct scraping is through repeated requests to visit a site with different IP addresses. Journalists and researchers use scraping as a reasearch technique, but when IP requests are directed quickly and en masse toward a specific site in order to overwhelm it and knock it offline, this constitutes a DDoS attack.

CPJ has documented DDoS attacks against outlets conducting critical journalism around the world. These cyberattacks also often take place alongside other threats to journalists’ safety and press freedom.

Qurium’s analysis shows that it blocked nearly 20,000 IP addresses from hitting the SJS website with millions of requests on August 18 and 19. The largest portion of the traffic (nearly 50%) came via RayoByte and its hosting partners, the analysis said. The second half of the traffic came through several other online channels, including virtual private networks (VPNs).

“We were very effective at mitigating the attack because within a few hours we realized we had seen this type of traffic before,” Qurium’s Lundström told CPJ. “We have met this [attacking] infrastructure in the past…this infrastructure is no joke.”

Similar DDoS attacks began almost immediately after Kosovo-based news site Nacionale began publishing in March 2022, covering local politics and social issues, co-founder Visar Arifaj told CPJ in a recent phone interview. “Our website would be down quite often. Because we were still fresh in the news market, it really had an impact for us to reach our audiences,” Arifaj said. “For us to be down a couple of hours during the day was a huge blow.”

Qurium began hosting and defending Nacionale in September 2022, and in March and April 2023 Qurium notified Sprious that attackers had been using its services against the outlet.

READ ALSO:

In emails from March, Qurium informed Sprious of attacks lasting “several hours non-stop.” One of the attacks “sourced” millions of web requests from IP addresses “publicly advertised by Rayobyte/BlazingSEO,” Qurium said. Sprious responded that it had “blacklisted” access to Nacionale’s website and it had barred the “user” responsible – which Sprious did not name — from accessing its services, but in April Qurium again tracked a DDoS attack against Nacionale involving RayoByte. In response to Qurium’s email about the April attack, Sprious said it had “discovered an issue” with its “security controls,” and had addressed it “to prevent further traffic.”

However, RayoByte-sourced internet traffic to Nacionale’s website did not stop and featured in DDoS attacks against the outlet in July and August, Lundström told CPJ. While Kosovo police arrested and prosecuted one man in connection with the cyberattacks and Qurium has successfully prevented the continued attacks from taking Nacionale offline, Lundström told CPJ that incoming traffic shows attackers continuing to harness IPs from a combination of proxy services, VPNs, and other sources.

Alongside the cyberattacks, Nacionale’s staff have been subjected to “constant” online harassment for their work and were recently physically attacked on the job, though those attackers have been arrested, Arifaj told CPJ. “This constant pressure, even when it doesn’t get to the journalists physically and in a direct manner, you can see that it does a lot for their burnout,” he added. “It does take a toll, mentally, on everyone.”

Since 2022, Qurium has additionally tracked DDoS attacks with IPs sourced from RayoByte against four other outlets: Peoples Gazette from Nigeria, Kloop from Kyrgyzstan, Bulatlat from the Philippines, and Turkmen.news, which reports on Turkmenistan from exile. The attacks on three of the four outlets, excluding Kloop, also involved traffic via VPNs.

In its statements to CPJ, Sprious said it investigates reports of DDoS attacks using its services and takes “appropriate actions with the end user that we believe is responsible” and “steps to mitigate the reported issues, including, but not limited to, blacklisting associated domains and working diligently to remove abusive users.”

The statements did not respond directly to CPJ’s requests for details of the customers responsible for these attacks and how the company responded in each case.

Lundström told CPJ that Sprious has yet to respond to Qurium’s emails concerning the attacks on Peoples Gazette, Kloop, Bulatlat, and Turkmen.news, as well as the additional attacks on Nacionale in July and August.

Proxies and VPNs have valid and important uses for ensuring internet users, including journalists, can maintain privacy online. Rights organizations, including CPJ, recommend the use of VPNs to defend against surveillance; individuals can use it to avoid state-backed online censorship, and companies use them to safeguard proprietary information. But Lundström described the use of proxy and VPN services to conduct DDoS attacks as a “weaponization” of these tools. “You’re hiding in a tool [made] for another purpose,” he said of the attackers. “I think it’s a strategic decision.”

READ ALSO:

“DDoS attacks are illegal under a section of the [U.S.] Computer Fraud and Abuse Act,” Gabe Rottman, director of the Technology and Press Freedom Project at the U.S.-based Reporters Committee for Freedom of the Press, which provides legal support to journalists, told CPJ. But he said that it is not necessarily illegal for proxy or VPN companies’ to provide services that are then used in DDoS attacks.

That doesn’t mean service providers can’t take actions. “You can have technology providers doing appropriate things to protect their users and others at the same time as they build their service in a way that protects privacy,” Rottman said. “If … you become aware of bad actors doing bad things, notify the authorities, stop them from using your service, mitigate the damage.”

Attacks on the SJS website have continued, Lundström told CPJ, though none of the IPs have come via RayoByte since Qurium and CPJ contacted Sprious for comment. Nevertheless, Lundström wants RayoByte’s leadership to do more to address the fact that attackers have repeatedly come to the company’s services to target media sites. “[RayoByte’s] making all the money,” he said. “And we have to do all this extra work and build new infrastructure to deal with all this shit.”

As for SJS, Abdalle remains worried about his colleague, who is still behind bars. But he says he’s confident that the press freedom group’s website will remain accessible.

He still doesn’t know the identity of the person or people who launched the cyberattack, but he imagines what they might be thinking: “Now they are witnessing, they are coming into a new reality that even after the attack SJS is still resilient. SJS is still active. SJS is still available and is able to work and operate effectively both online and physically inside Somalia.”

Jonathan Rozen is CPJ’s senior Africa researcher. Previously, he worked in South Africa, Mozambique, and Canada with the Institute for Security Studies, assessing Mozambican peace-building processes. He also wrote analyses for the think tank adelphi on links between climate action and conflict prevention. Rozen was a U.N. correspondent for IPS News and has written for Al-Jazeera English and the International Peace Institute.

Cyberattackers used US company RayoByte in efforts to crash media sites

Related Topics:Cyberattackers media sites US

Up Next

Niger military accuses France of deploying forces with view to ‘intervention’

Don't Miss

Detained ex-Gabon President Ali Bongo released for overseas medical treatment

International

Iran to US: No Nuclear Deal Without Guarantee of Our Rights

Published

2 days ago

May 31, 2026

Trends Admin

Iran’s chief negotiator, Mohammad Bagher Ghalibaf

Iran to US: No Nuclear Deal Without Guarantee of Our Rights

TEHRAN – Iran’s chief negotiator, Mohammad Bagher Ghalibaf, has firmly ruled out any agreement with the United States unless the rights of the Iranian people are fully guaranteed, signaling a major hurdle in ongoing diplomatic efforts to end the Middle East conflict that erupted on February 28.

In a video broadcast on state television on Sunday, Ghalibaf declared, “We will not approve any agreement until we are certain that the rights of the Iranian people have been upheld.” He added that Tehran’s negotiating team “neither trust the enemy’s words nor its promises,” underscoring a deep and persistent distrust of US guarantees that has defined the Islamic Republic’s bargaining stance for decades.

The强硬 Iranian position comes as the White House pushes forward with a revised proposal. On Saturday, The New York Times and Axios reported that US President Donald Trump returned a draft framework to Tehran with “tougher” terms than previously discussed. According to US officials cited by Axios, the revisions focus on stricter clauses regarding Iran’s enriched uranium stockpile and the reopening of the Strait of Hormuz —a chokepoint through which nearly 20% of global oil passes. One senior official said the changes include “more specifics about how the US gets the material and the timing” regarding Iran’s nuclear activities. President Trump, while publicly expressing a desire for a deal, has kept military action on the table. “We are making a great deal; otherwise we’ll just go back and finish it off militarily,” Trump told Fox News this week.

READ ALSO:

Tehran has laid out a clear list of rights it says must be enshrined in any final agreement. First among these is sanctions relief: Iran demands the lifting of all US economic sanctions imposed since 2018, as the Iranian rial has lost over 80% of its value under the current regime of restrictions. Second, Tehran is seeking the release of approximately $12 billion in frozen assets held in banks abroad, which it views as Iranian property unlawfully withheld. Third, since the war began on February 28, Iran has maintained tight military and naval control over the Strait of Hormuz. Iranian Foreign Ministry spokesman Esmaeil Baghaei recently stated that future management of the waterway “concerns only Iran and Oman,” and local media reports indicate a parliamentary plan to codify Iranian sovereignty over the strait is imminent.

Despite the tough rhetoric, a draft 60-day truce memorandum of understanding (MOU) had reportedly been agreed upon by negotiators from both sides pending Trump’s approval. The MOU allegedly includes provisions for mine clearance by Iran, the reopening of the strait, and preliminary discussions on sanctions relief. However, Trump’s decision to return the framework with tougher conditions has introduced fresh delays. Iranian officials are expected to issue a formal response within approximately three days. Meanwhile, a ceasefire that has largely held since April 8 remains fragile, with both sides accusing each other of violations.

The stalemate has kept the entire Middle East on edge. The war that began on February 28 has already displaced over 1.2 million people, according to UN estimates, and has drawn in proxy forces from Lebanon, Syria, and Yemen. A failure to reach a deal could trigger a wider regional conflagration, while a successful agreement—however unlikely under current terms—would reshape Gulf security and global energy markets.

Iran to US: No Nuclear Deal Without Guarantee of Our Rights

International

US Warns Iran of Fresh War as Nuclear Deal Talks Hit Roadblock

Published

2 days ago

May 30, 2026

Trends Admin

US Warns Iran of Fresh War as Nuclear Deal Talks Hit Roadblock

Fresh fears of renewed conflict in the Middle East have emerged after the United States warned it is fully prepared to restart military operations against Iran if ongoing negotiations fail to produce a peace agreement.

The warning came as efforts to secure a diplomatic breakthrough between Washington and Tehran remain uncertain, despite reports that an initial ceasefire extension framework is awaiting final approval from President Donald Trump.

Speaking at the Shangri-La Dialogue defence summit in Singapore on Saturday, US Defence Secretary Pete Hegseth declared that Washington has the military capacity to resume hostilities if necessary.

He said the United States remains fully equipped to launch fresh strikes, stressing that American military stockpiles are strong enough to sustain operations both in the Middle East and across other global theatres.

The comments signalled growing pressure on Tehran as diplomatic negotiations continue behind closed doors.

The warning followed a two-hour high-level meeting held by President Trump and senior national security officials in the White House Situation Room on Friday to assess a proposed framework aimed at extending the current ceasefire by 60 days.

US officials familiar with the talks said the draft agreement remains under review, with Trump yet to make a final decision.

The White House has maintained that any US-Iran peace deal must meet Trump’s strict red lines, including a permanent guarantee that Iran will never develop nuclear weapons and the immediate reopening of the Strait of Hormuz to unrestricted international shipping.

A White House official said Trump would only approve a deal that protects American strategic interests and prevents Iran from acquiring nuclear capabilities.

READ ALSO:

The Strait of Hormuz, one of the world’s most critical maritime oil routes, has become a central point of contention in the talks.

The waterway carries nearly one-fifth of global oil shipments, and its disruption has triggered market instability, pushed up oil prices and raised fears of wider economic consequences.

As part of the proposed framework, Trump has reportedly demanded that Tehran remove naval mines from the waterway and guarantee toll-free commercial access.

The proposal would also reportedly require cooperation on dismantling Iran’s enriched uranium stockpile, while the United States would ease certain restrictions affecting Iranian shipping and port access.

However, Tehran has sharply rejected several of Washington’s demands.

Iranian Foreign Ministry spokesperson Esmaeil Baqaei insisted no final agreement had been reached and dismissed what he described as attempts to impose conditions on the Islamic Republic.

He said Iran had long rejected the language of ultimatums and confirmed that indirect diplomatic exchanges were still ongoing through regional mediators.

Iranian President Masoud Pezeshkian reportedly told Qatar’s Emir during a phone conversation that Tehran remains willing to pursue what he called a “dignified framework” for peace, provided Iran’s sovereignty is respected.

Meanwhile, Iranian state-linked media challenged several claims made by Trump regarding the negotiations.

The semi-official Fars News Agency reported that Tehran is demanding the immediate release of $12 billion in frozen Iranian assets before agreeing to the next phase of discussions.

The report also denied claims that Iran had agreed to permanently reopen the Strait of Hormuz without tolls or surrender control over its nuclear material.

Military tensions have further complicated the fragile diplomacy.

Recent US airstrikes on Bandar Abbas, a strategic southern Iranian port, were met with retaliatory Iranian missile and drone attacks, raising fears that both nations could slide back into direct conflict.

Regional efforts to broker a durable ceasefire are being led by Pakistan, with support from Qatar and Oman, while parallel negotiations continue over the conflict in Lebanon, which Iran insists must form part of any broader settlement.

Israeli Prime Minister Benjamin Netanyahu added another layer of complexity by announcing that Israeli forces had expanded military operations, even as military delegations from both countries held separate consultations in Washington.

For many ordinary Iranians, the mixed signals from both sides have created uncertainty over whether peace is genuinely close.

A resident of Tonekabon in northern Iran said public statements from Washington and Tehran appear designed more to satisfy domestic audiences than reflect actual progress at the negotiating table.

Analysts say the next few days could prove decisive as negotiators attempt to bridge deep divisions over Iran’s nuclear programme, sanctions relief, regional security guarantees and freedom of navigation through the Gulf.

With tensions still high, the prospect of renewed military confrontation remains a serious concern for global markets and regional stability.

US Warns Iran of Fresh War as Nuclear Deal Talks Hit Roadblock

International

Nigerian Catholic Priest Convicted in US for Sexually Abusing Women Seeking Spiritual Help

Published

2 days ago

May 30, 2026

Trends Admin

Roman Catholic priest Anthony Odiong

Nigerian Catholic Priest Convicted in US for Sexually Abusing Women Seeking Spiritual Help

A Texas jury has convicted former Nigerian Catholic priest Anthony Odiong of sexually assaulting women who sought spiritual guidance, bringing to a close a closely watched criminal trial that exposed years of alleged abuse of trust and clerical authority.

The 57-year-old was found guilty on one count of first-degree sexual assault and two counts of second-degree sexual assault after jurors deliberated for about two hours in Waco, Texas, on Friday.

The jury, made up of eight women and four men, reached the verdict after hearing testimony from two women who accused the former priest of exploiting his role as a spiritual adviser to initiate and sustain abusive sexual relationships during periods when they were emotionally vulnerable.

The conviction means Odiong now faces a possible life sentence on the first-degree charge, while each second-degree conviction carries a prison term of between two and 20 years. Sentencing proceedings are scheduled to begin Monday before the same jury.

The case drew widespread public attention after multiple women accused the former cleric of using his religious authority to manipulate parishioners under his pastoral care.

During the trial, one of the complainants, identified in court as Mary Doe, testified that Odiong began sexually abusing her while serving as her spiritual adviser as she struggled through a difficult divorce and cared for seven children.

She told the court the abuse continued for years and recounted how one of her sons once walked in on them having sexual intercourse in her bedroom following a family gathering.

According to courtroom testimony, when confronted, Odiong allegedly attempted to justify the encounter by telling her, “We are but men.”

A second complainant, identified as Jane Doe, told jurors she sought spiritual counselling from Odiong while trapped in an abusive marriage.

READ ALSO:

She testified that he pressured her into permitting painful sexual acts with her husband and later demanded detailed accounts of those encounters during counselling sessions.

Prosecutors argued that the conduct constituted sexual assault under Texas law, which criminalises sexual exploitation by clergy members who abuse positions of trust over vulnerable individuals receiving spiritual or emotional guidance.

A third accuser was expected to testify but prosecutors dropped that portion of the case after describing her emotional state as extremely fragile.

They said they chose not to compel her appearance in court due to concerns over her psychological wellbeing.

Both women testified that they met Odiong while he served at St Peter Catholic Student Center in Waco, a church frequented by students and employees of Baylor University, placing them within his pastoral reach.

Jurors also heard evidence that DNA testing established Odiong fathered a child in 2023 with Presley Jones, a woman he had also reportedly counselled spiritually while serving as pastor of St Anthony of Padua Church in Louisiana.

Although Louisiana prosecutors did not pursue charges because the state lacks a clergy sexual assault law similar to Texas, prosecutors in the Waco trial presented the evidence to demonstrate what they described as a broader pattern of sexual exploitation involving women under his spiritual authority.

Odiong, originally ordained in Nigeria’s Catholic Diocese of Uyo in 1993, served in churches across Texas, Louisiana and Florida before church authorities suspended him following mounting allegations.

The allegations first became public in 2024 following investigative reports that detailed accusations of sexual coercion, unwanted touching and financial manipulation involving women under his pastoral care.

Authorities later identified additional complainants, strengthening the prosecution’s case despite the age of some of the allegations.

Court observers reported that Odiong showed little visible emotion as Judge Thomas West read the verdict.

He reportedly stared straight ahead before lowering his head as deputies escorted him from the courtroom.

The conviction marks a significant moment in efforts to hold clergy accountable for abuse of trust and power within religious institutions.