Cyberattackers used US company RayoByte in efforts to crash media sites - Newstrends
Connect with us

International

Cyberattackers used US company RayoByte in efforts to crash media sites

Published

3 years ago

on

Cyberattackers

THE cyberattack against the Somali Journalists Syndicate could not have come at a worse time. A distributed denial-of-service attack known by its acronym DDoS, flooded the local press freedom group’s website with traffic in early August and knocked it offline.

Days later, authorities arrested SJS staff member and Kaab TV editor Mohamed Ibrahim Osman Bulbul in connection with his reporting on alleged corruption. The tandem crises placed major strain on the organization.

“It was a very traumatic week. Sleepless. Very stressful. We could not publish our statement, the first statement of Mohamed’s detention,” SJS secretary general Abdalle Ahmed Mumin told CPJ in an interview from the U.K., where he fled earlier this year after he was repeatedly arrested by Somali authorities. “Imagine someone attacking your team, detaining one of your team, and you’re not able to communicate to the international world because your website has been taken down.”

SJS found some relief when it connected with Qurium, a Sweden-based nonprofit that began hosting SJS’s website. But a week after the initial attack, another DDoS flood hit the website. This time, Qurium was able to protect SJS from going offline. Qurium’s analysis of these additional attacks also found that a U.S. company, RayoByte, had provided the tools used in the attack.

Sprious, which owns RayoByte, told Qurium in an email, which CPJ reviewed, that it had “removed the abusive user” from its network and added the SJS site to its “blacklist” to prevent it from being targeted further.

SJS isn’t the only news outlet that has suffered a DDoS attack using RayoByte’s services. News outlets from at least five other countries — Kosovo, Nigeria, Kyrgyzstan, the Philippines, and Turkmenistan — have faced similar attacks over the last two years, according to Qurium’s analysis. These incidents provide a rare look at the mechanics of online censorship efforts and how private corporations can profit from them.

READ ALSO:

Sprious declined CPJ’s requests for an interview and did not directly answer a list of written questions. But in emailed statements to CPJ, Sprious said it was “deeply concerned” about reports that its services were “allegedly” used in DDoS attacks. “We firmly stand against any form of online harassment or harm, including cyber-attacks, especially when it concerns entities that play a crucial role in promoting press freedom and the safety of journalists,” it said.

Headquartered in Lincoln, Nebraska, Rayobyte, formerly known as Blazing SEO, is one of many companies that sells clients access to Internet Protocol (IP) addresses, unique numbers assigned to internet-connected devices, for “scraping,” a method for extracting large amounts of data from websites. RayoByte’s website lists a range of prices for access to IP addresses based on variables including type and speed.

One way to conduct scraping is through repeated requests to visit a site with different IP addresses. Journalists and researchers use scraping as a reasearch technique, but when IP requests are directed quickly and en masse toward a specific site in order to overwhelm it and knock it offline, this constitutes a DDoS attack.

CPJ has documented DDoS attacks against outlets conducting critical journalism around the world. These cyberattacks also often take place alongside other threats to journalists’ safety and press freedom.

Qurium’s analysis shows that it blocked nearly 20,000 IP addresses from hitting the SJS website with millions of requests on August 18 and 19. The largest portion of the traffic (nearly 50%) came via RayoByte and its hosting partners, the analysis said. The second half of the traffic came through several other online channels, including virtual private networks (VPNs).

“We were very effective at mitigating the attack because within a few hours we realized we had seen this type of traffic before,” Qurium’s Lundström told CPJ. “We have met this [attacking] infrastructure in the past…this infrastructure is no joke.”

Similar DDoS attacks began almost immediately after Kosovo-based news site Nacionale began publishing in March 2022, covering local politics and social issues, co-founder Visar Arifaj told CPJ in a recent phone interview. “Our website would be down quite often. Because we were still fresh in the news market, it really had an impact for us to reach our audiences,” Arifaj said. “For us to be down a couple of hours during the day was a huge blow.”

Qurium began hosting and defending Nacionale in September 2022, and in March and April 2023 Qurium notified Sprious that attackers had been using its services against the outlet.

READ ALSO:

In emails from March, Qurium informed Sprious of attacks lasting “several hours non-stop.” One of the attacks “sourced” millions of web requests from IP addresses “publicly advertised by Rayobyte/BlazingSEO,” Qurium said. Sprious responded that it had “blacklisted” access to Nacionale’s website and it had barred the “user” responsible – which Sprious did not name — from accessing its services, but in April Qurium again tracked a DDoS attack against Nacionale involving RayoByte. In response to Qurium’s email about the April attack, Sprious said it had “discovered an issue” with its “security controls,” and had addressed it “to prevent further traffic.”

However, RayoByte-sourced internet traffic to Nacionale’s website did not stop and featured in DDoS attacks against the outlet in July and August, Lundström told CPJ. While Kosovo police arrested and prosecuted one man in connection with the cyberattacks and Qurium has successfully prevented the continued attacks from taking Nacionale offline, Lundström told CPJ that incoming traffic shows attackers continuing to harness IPs from a combination of proxy services, VPNs, and other sources.

Alongside the cyberattacks, Nacionale’s staff have been subjected to “constant” online harassment for their work and were recently physically attacked on the job, though those attackers have been arrested, Arifaj told CPJ. “This constant pressure, even when it doesn’t get to the journalists physically and in a direct manner, you can see that it does a lot for their burnout,” he added. “It does take a toll, mentally, on everyone.”

Since 2022, Qurium has additionally tracked DDoS attacks with IPs sourced from RayoByte against four other outlets: Peoples Gazette from Nigeria, Kloop from Kyrgyzstan, Bulatlat from the Philippines, and Turkmen.news, which reports on Turkmenistan from exile. The attacks on three of the four outlets, excluding Kloop, also involved traffic via VPNs.

In its statements to CPJ, Sprious said it investigates reports of DDoS attacks using its services and takes “appropriate actions with the end user that we believe is responsible” and “steps to mitigate the reported issues, including, but not limited to, blacklisting associated domains and working diligently to remove abusive users.”

The statements did not respond directly to CPJ’s requests for details of the customers responsible for these attacks and how the company responded in each case.

Lundström told CPJ that Sprious has yet to respond to Qurium’s emails concerning the attacks on Peoples Gazette, Kloop, Bulatlat, and Turkmen.news, as well as the additional attacks on Nacionale in July and August.

Proxies and VPNs have valid and important uses for ensuring internet users, including journalists, can maintain privacy online. Rights organizations, including CPJ, recommend the use of VPNs to defend against surveillance; individuals can use it to avoid state-backed online censorship, and companies use them to safeguard proprietary information. But Lundström described the use of proxy and VPN services to conduct DDoS attacks as a “weaponization” of these tools. “You’re hiding in a tool [made] for another purpose,” he said of the attackers. “I think it’s a strategic decision.”

READ ALSO:

“DDoS attacks are illegal under a section of the [U.S.] Computer Fraud and Abuse Act,” Gabe Rottman, director of the Technology and Press Freedom Project at the U.S.-based Reporters Committee for Freedom of the Press, which provides legal support to journalists, told CPJ. But he said that it is not necessarily illegal for proxy or VPN companies’ to provide services that are then used in DDoS attacks.

That doesn’t mean service providers can’t take actions. “You can have technology providers doing appropriate things to protect their users and others at the same time as they build their service in a way that protects privacy,” Rottman said. “If … you become aware of bad actors doing bad things, notify the authorities, stop them from using your service, mitigate the damage.”

Attacks on the SJS website have continued, Lundström told CPJ, though none of the IPs have come via RayoByte since Qurium and CPJ contacted Sprious for comment. Nevertheless, Lundström wants RayoByte’s leadership to do more to address the fact that attackers have repeatedly come to the company’s services to target media sites. “[RayoByte’s] making all the money,” he said. “And we have to do all this extra work and build new infrastructure to deal with all this shit.”

As for SJS, Abdalle remains worried about his colleague, who is still behind bars. But he says he’s confident that the press freedom group’s website will remain accessible.

He still doesn’t know the identity of the person or people who launched the cyberattack, but he imagines what they might be thinking: “Now they are witnessing, they are coming into a new reality that even after the attack SJS is still resilient. SJS is still active. SJS is still available and is able to work and operate effectively both online and physically inside Somalia.”

Jonathan Rozen is CPJ’s senior Africa researcher. Previously, he worked in South Africa, Mozambique, and Canada with the Institute for Security Studies, assessing Mozambican peace-building processes. He also wrote analyses for the think tank adelphi on links between climate action and conflict prevention. Rozen was a U.N. correspondent for IPS News and has written for Al-Jazeera English and the International Peace Institute.

Cyberattackers used US company RayoByte in efforts to crash media sites

Loading

Related Topics:
Advertisement

International

BREAKING: Bloodbath at Pakistan Mosque as Suicide Blast Kills 21, Injures 103

Published

31 minutes ago

on

September 18, 2026

By

Bloodbath at Pakistan Mosque as Suicide Blast Kills 21, Injures 103

BREAKING: Bloodbath at Pakistan Mosque as Suicide Blast Kills 21, Injures 103

KOHAT, Pakistan — Friday prayers turned into a scene of horror in Pakistan on Friday as a powerful suicide attack ripped through a mosque inside a police compound in Kohat, leaving at least 21 people dead and 103 others injured.

The devastating attack, which struck the Old Police Lines in Kohat, Khyber Pakhtunkhwa province, claimed the lives of 15 police personnel and six civilians, while 73 policemen and 30 civilians were injured, according to health officials.

The attack occurred at about 1:20pm local time, when worshippers had gathered for the weekly Friday prayers at the mosque located inside the heavily guarded Police Lines compound.

Eyewitness accounts and initial reports described scenes of panic as a massive explosion tore through the facility, sending debris flying and trapping victims beneath damaged sections of the mosque and surrounding buildings.

According to Khyber Pakhtunkhwa Inspector-General of Police Zulfiqar Hamid, an explosives-laden vehicle was rammed into the gate of the old Police Lines before detonating, unleashing the devastating blast.

The explosion caused extensive damage to the police facility and mosque, with parts of the structure collapsing as worshippers and police officers were caught in the blast.

But the nightmare did not end with the explosion.

As rescue workers rushed to evacuate the wounded, gunfire erupted inside the compound after armed militants reportedly attempted to force their way deeper into the police facility.

A further suicide explosion was also reported near the Special Branch building during the ensuing confrontation between the attackers and security forces.

READ ALSO:

Police said seven armed attackers had entered the compound following the initial assault, triggering a fierce firefight involving police and Counter-Terrorism Department personnel.

Security forces eventually killed the attackers, including a suicide bomber and a sniper, as they battled to regain control of the compound.

The scale of the casualties overwhelmed medical facilities in Kohat, forcing the District Headquarters Hospital to declare an emergency.

Ambulances raced to the scene as doctors and medical workers treated scores of victims suffering blast injuries, gunshot wounds and injuries caused by collapsing structures.

Health authorities put the number of injured at 103, with 73 police personnel and 30 civilians among those receiving treatment.

Some of the wounded were reportedly in critical condition, while rescue teams continued searching the damaged compound for possible survivors trapped under debris.

The heavy police casualties were attributed to the location and timing of the attack, with officers among those gathered inside the mosque for Friday prayers.

Among those reportedly killed were SP Traffic Akbar Shinwari and Dr Israel Orakzai, head of the children’s department at DHQ KDA Kohat, according to Pakistani media reports.

Security forces subsequently cordoned off the area and restricted movement around the Police Lines as investigators began examining the scene and searching for explosives or possible accomplices.

The Kohat-Hangu Road was also closed temporarily as security and rescue operations continued.

The attack triggered widespread outrage across Pakistan, with President Asif Ali Zardari and Prime Minister Shehbaz Sharif condemning the bombing and mourning the victims.

Sharif directed authorities to ensure that the injured received immediate and adequate medical treatment while security agencies were ordered to investigate the attack.

Khyber Pakhtunkhwa Chief Minister Sohail Afridi also condemned the assault and directed officials to mobilise available resources for the treatment of the wounded.

Interior Minister Mohsin Naqvi expressed solidarity with the families of those killed and injured, as condemnation poured in from within and outside Pakistan.

Countries including Saudi Arabia, the United Kingdom, Russia, Poland, Australia and Jordan also condemned the attack and expressed sympathy with the victims and their families.

The Kohat bombing comes against the backdrop of an escalating militant threat in Khyber Pakhtunkhwa, one of Pakistan’s most violence-prone regions.

The province, which shares a border with Afghanistan, has witnessed repeated attacks targeting police, soldiers and civilians.

The latest bloodshed also came shortly after a roadside bombing in neighbouring Hangu district reportedly killed six soldiers, further raising security concerns in the region.

Pakistan has repeatedly accused militants linked to the Tehrik-e-Taliban Pakistan (TTP) of using hideouts in Afghanistan to launch attacks inside Pakistan. Afghanistan’s Taliban authorities have consistently rejected allegations that they permit their territory to be used for attacks against Pakistan.

Responsibility for the Kohat attack remained disputed in the immediate aftermath.

While later reports attributed a claim to a faction associated with the TTP, other reports said the TTP denied involvement. Security authorities have therefore continued investigations to establish the identity of those behind the attack and determine whether others assisted the attackers.

The deadly incident has also drawn painful memories of the January 2023 Police Lines mosque bombing in Peshawar, in which more than 100 people, mostly police officers, were killed.

For residents of Kohat, Friday’s attack once again turned a place of worship into a battlefield, leaving families searching for loved ones and hospitals struggling to cope with the influx of casualties.

As security agencies combed through the wreckage and investigators worked to establish the circumstances surrounding the assault, the death toll and number of injured remained subject to further updates.

At least 21 people are confirmed dead and 103 injured in the latest official figures, with fears that the casualty figures could change as authorities complete rescue and medical operations.

BREAKING: Bloodbath at Pakistan Mosque as Suicide Blast Kills 21, Injures 103

Loading

Continue Reading

International

Teen Gunman Kills Two Students, Injures Eight in Philippine School

Published

2 hours ago

on

September 18, 2026

By

Teen Gunman Kills Two Students, Injures Eight in Philippine School

Teen Gunman Kills Two Students, Injures Eight in Philippine School

A school shooting in the Philippines has left two 14-year-old students dead and eight others injured after a 16-year-old student opened fire at Banga National High School in South Cotabato before taking his own life.

The incident happened at about 1:30 p.m. on Friday, September 18, in Banga town on the southern island of Mindanao, sending students fleeing from the school as emergency responders moved in to attend to the victims.

South Cotabato Governor Reynaldo Tamayo said the two students killed were a boy and a girl, both aged 14. The suspected shooter, a Grade 9 student at the school, also died after shooting himself following the attack.

Banga Mayor Albert Palencia said the teenager opened fire inside a classroom neighbouring his own, hitting 10 students. Two of the victims died while eight others were wounded. Four of those injured were reported to be in critical condition.

The mayor said the teenager had reportedly warned some of his friends before the shooting that he intended to carry out a plan after lunch and advised them to go home because they could become involved. His friends reportedly dismissed the warning, believing he was joking.

After lunch, the teenager reportedly left his classroom and entered a neighbouring classroom, where he began shooting at fellow students. He then changed the magazine of the firearm before shooting himself.

Authorities are investigating how the teenager obtained the firearm and brought it into the school.

According to local officials, the gun belonged to the teenager’s father, an employee of the Philippine Department of Education. The firearm had reportedly been kept in a secured vault, which the teenager allegedly broke open before taking the weapon to school.

The circumstances surrounding the weapon have become a major focus of the investigation, particularly because the suspected shooter was a minor.

South Cotabato Governor Tamayo urged gun owners and parents to ensure that firearms are securely stored and inaccessible to children, stressing that school security personnel alone cannot prevent every possible threat.

Authorities are also investigating reports about the teenager’s involvement in an online True Crime Community, described by officials as an internet group where young people discuss violent crimes and, in some cases, glorify school shooters.

READ ALSO:

Authorities have not established that the online activity caused or directly motivated the attack, and investigations into the teenager’s background and possible motive remain ongoing.

The teenager’s mother had reportedly expressed concern about him and was considering taking him for psychiatric assistance, according to information cited by local officials. The circumstances surrounding his behaviour and possible motive remain under investigation.

Emergency responders took the injured students to hospitals in the area, including the South Cotabato Provincial Hospital and Surallah Community Hospital.

The Philippine Department of Education said the safety and wellbeing of students, teachers and school personnel remained its immediate priority. In-person classes in the affected area were suspended, while authorities coordinated medical assistance and psychosocial support for students and staff affected by the incident.

President Ferdinand Marcos Jr. ordered a thorough investigation into the shooting, particularly how a minor was able to obtain a firearm and bring it inside a school.

Marcos also expressed condolences to the families of the victims and directed relevant authorities to establish the circumstances surrounding the incident.

The shooting has renewed concerns over school security, gun storage and minors’ access to firearms in the Philippines, particularly as the country has experienced several deadly school attacks in recent months.

The Banga incident is the third deadly school shooting in the Philippines since June.

In June, a shooting at a public high school in Tacloban City left three students dead and about 20 others injured after two students reportedly opened fire on the campus.

In August, another student in Zamboanga reportedly livestreamed the killing of a fellow student before taking his own life.

The incidents have prompted increased attention to school security and emergency preparedness. The Philippine Department of Education conducted nationwide school safety drills earlier this month as part of efforts to improve responses to armed attacks and other emergencies.

Authorities are now expected to examine not only the circumstances of the Banga shooting but also how the teenager gained access to the weapon, how it was taken into the school and whether any online activity contributed to his actions.

Early reports from authorities gave different casualty figures as emergency teams responded to the shooting. Later reports from local officials, police and national news agencies converged around two student deaths, the death of the 16-year-old suspected gunman and eight injured students, although some reports continued to carry different figures while the investigation was ongoing.

The Banga community is now mourning the two young students killed in the attack, while the injured students remain under medical care and authorities continue their investigation into the country’s latest deadly school shooting.

Teen Gunman Kills Two Students, Injures Eight in Philippine School

Loading

Continue Reading

International

Ninth Body Discovered in South Africa: Nigeria Issues Urgent Safety Alert to Nationals

Published

13 hours ago

on

September 18, 2026

By

Ninth Body Discovered in South Africa: Nigeria Issues Urgent Safety Alert to Nationals

Police cordon off Kempton Park and post a $56,000 combined bounty as the Nigerian Consulate warns citizens to exercise heightened vigilance.

South African police recovered the body of a ninth woman on Thursday along a roadside in Dawn Park, intensifying public alarm and prompting the Nigerian Consulate-General in Johannesburg to issue an emergency safety advisory to its citizens.

In response to the discoveries, law enforcement teams placed Kempton Park in the Ekurhuleni municipality under lockdown and established roadblocks to inspect vehicles and restrict suspect movement.

Deputy Police Chief Tebello Mosikili declared during a press conference that authorities will deploy specialized investigative units to track down those responsible.

To accelerate breakthroughs, police offered a 400,000 rand ($25,000) reward for credible tips, while South Africa’s Democratic Alliance provided an additional $31,000, establishing a combined bounty of $56,000.

Detectives are now evaluating forensic evidence to determine whether one perpetrator committed the murders or whether independent offenders copied earlier attacks.

Meanwhile, the Nigerian Consulate-General urged Nigerian residents, especially women and young people who commute, exercise, or study around Ekurhuleni, to take deliberate personal precautions.

The mission advised community members to travel in groups, stay clear of isolated trails, and share real-time travel details with trusted family members.

Furthermore, diplomatic officials emphasized that safety precautions must not shift the burden of crime prevention onto women, calling on South African authorities to ensure thorough investigations and justice for every victim.

Ninth Body Discovered in South Africa: Nigeria Issues Urgent Safety Alert to Nationals

Loading

Continue Reading

Trending