Baitaphish
Security intelligence
SearchLatest briefing
Curated incident record

Dyn DNS DDoS attack causes widespread internet service disruption

Dyn reported large-scale distributed denial-of-service (DDoS) attacks against its managed DNS infrastructure on October 21, 2016, causing widespread service disruption for many internet platforms that depended on Dyn DNS resolution. U.S. prosecutors later announced guilty pleas related to the creation and operation of the Mirai botnet, which was used in major DDoS attacks during the period, including attacks affecting Dyn. The incident highlighted systemic availability risk from botnet-driven DDoS on core internet services.
First reported October 21, 2016Outagemed overall confidence
Incident library
First reportedOctober 21, 2016
ActivityOctober 21, 2016
Last updatedFeb 2, 2026, 12:00 AM UTC
Record confidencemed

Key facts

Affected

  • Dyn (DNS provider)
  • Internet platforms and customers relying on Dyn DNS
  • End users experiencing outages of dependent services

Initial access

  • unknown

Impact

  • service_disruption
  • financial_loss

Attribution

Mirai botnet operators (criminal case) med confidence

DOJ filings describe Mirai botnet creation and operations; specific operator attribution for the Dyn attack is not fully detailed in the cited Dyn analysis summary.

CVEs and ATT&CK

CVEs

ATT&CK techniques

T1498 · high
  • T1498: Dyn described large-scale DDoS attacks against its DNS infrastructure that disrupted availability.

Mitigations

Now

  • Use DDoS protection and rate limiting at the edgeAbsorbs volumetric attacks and prevents saturation of critical services such as DNS and web front doors.

Soon

  • Harden IoT/edge devices (change defaults, disable unnecessary services, patch firmware)Reduces the pool of exploitable devices that botnets leverage to generate attack traffic.

Later

  • Design resilient DNS and critical services (anycast, multi-provider failover)Improves availability during attacks and reduces single points of failure.

Detection ideas

Detect volumetric traffic spikes and anomalous protocol floods

Alert on sudden sustained traffic volume increases, high PPS, or unusual amplification patterns (DNS/NTP/SSDP).

Data sources: NetFlow/flow logs, Firewall logs, Load balancer metrics

Detect scanning and brute forcing of default IoT credentials

Look for widespread telnet/SSH scanning (23/2323/22) and repeated authentication failures from many source IPs.

Data sources: NetFlow/flow logs, IDS alerts, Firewall logs

Sources