Pro-Iran 313 Team DDoS knocks Ubuntu and Canonical web services offline, then demands contact

On 1 May 2026, Canonical, the company behind the Ubuntu Linux distribution, confirmed that its web infrastructure was under a distributed denial-of-service (DDoS) attack. The hacktivist group The Islamic Cyber Resistance in Iraq, known as 313 Team, claimed responsibility.

Services affected

More than a dozen domains and services went down or returned errors, including ubuntu.com, canonical.com, security.ubuntu.com, archive.ubuntu.com, developer.ubuntu.com and portal.canonical.com. Users could not download Ubuntu images through the usual channels or log in to their Canonical accounts, and reports showed update operations failing on some Ubuntu systems during the outage. The Ubuntu security APIs for CVEs and security notices, which patch-management tools rely on, were also disrupted.

Canonical said its teams were "working to restore full availability to all affected services." By 4 May, all affected services appeared to have recovered.

From hacktivism to shakedown

313 Team turned the attack into an extortion attempt. On Telegram, the group told Canonical it had emailed a Session messenger contact ID and warned that it would continue the assault if the company did not reach out. In the preceding month the group had also claimed DDoS attacks against eBay's U.S. and Japanese sites and the Bluesky social network. Its motive for choosing Canonical was not clear.

Why it matters

The attack hit the distribution and security-advisory infrastructure that millions of servers and desktops depend on, at a time of heightened activity by pro-Iran groups against Western targets. Even without any data theft, knocking package archives and vulnerability feeds offline can stall patching across a large part of the Linux ecosystem.