An independent news website based in Russia, Meduza, has been under attack as researchers uncover repeated attempts to disrupt its digital infrastructure. Following a cyber campaign in March, which the organization attributed to the Russian authorities, Meduza has continued to face onslaughts increasing in intensity and variety.
The Sweden-based digital forensics organization Qurium released a report this week detailing the ongoing distributed denial-of-service (DDoS) attacks against Meduza. These attacks flood the website with traffic, aiming to disrupt or bring it down.
Meduza, which prides itself on being an independent media outlet free from Kremlin control, has been designated as an “undesirable organization” by the Russian government in 2023. Despite relocating its office to Latvia in 2014, Meduza remains a target for cyberattacks originating from outside Europe.
In April, Meduza experienced two large-scale DDoS attacks, prompting an investigation by Qurium. The first attack, lasting 48 hours, saw the website targeted by 2 billion fake user requests. The second attack, lasting one hour, used 10 times more IP addresses than the previous one.
According to Qurium’s analysis, the botnet behind the attacks likely operated from compromised routers or malware in desktop computers. The attacks were facilitated by proxy providers Plain Proxies, Min Proxy, and RapidSeedBox, making it difficult for Meduza to defend against or mitigate the cyber threats.
In response to Qurium’s findings, Meduza pointed fingers at the Kremlin, stating, “We know that this is a very expensive attack, and its purpose is not just to disrupt the operation of our website and mobile application, but to make our resources stop working. Only Russian authorities can have such a goal. And they will continue trying to achieve it.”
