brain-SCC

Summary

brain-SCC reported a large-scale DDoS attack on its infrastructure that disrupted access to several municipal websites. The attack generated massive traffic spikes through central proxies, causing temporary slowdowns or outages for both targeted and indirectly affected online services. While administrative functions such as online appointment booking remained operational, the websites of multiple districts and cities, including those of Burgenlandkreis, Lützen, Magdeburg and Halberstadt, experienced limited availability. No data exfiltration was detected, and normal access was restored after the traffic surge subsided. The incident is part of a broader wave of similar attacks targeting public institutions in the region.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Tuesday, 29 July 2025, the infrastructure of brain‑SCC was targeted by a large‑scale DDoS attack aimed at municipal web presences. The attack traffic was routed through central proxy servers, generating massive access peaks that overwhelmed the targeted sites. Because the proxy infrastructure also supports other services, the surge caused temporary impairment of even those systems that were not directly attacked. The effects were noticeable throughout the entire day, with periods of degraded or limited availability.

During the attack, the websites of the Burgenlandkreis, the town of Lützen, and several other municipalities in Saxony‑Anhalt became unreachable. Online services such as the district administration’s appointment booking system remained operational, according to official statements. No data exfiltration was observed at any point. Reports from the news agency dpa indicated that the online presences of Magdeburg and Halberstadt were also affected by the same traffic surge. The disruption was limited to accessibility; the internal work of the administrations continued unaffected.

In the afternoon of the same day, the Burgenlandkreis and Lützen websites were reported to be reachable again, although the press spokesperson for Lützen, Camilo Rodriguez, noted that the restoration was initially ‘nicht ganz ruckelfrei’. The incident fits into a broader pattern of DDoS attacks against public institutions in Saxony‑Anhalt, following earlier attacks on several ministry portals and repeated incidents reported by regional media outlets MZ and MDR. No further details about attacker identity or specific mitigation measures are provided in the source material.

Sources

Sources available to members: 2 sources.