KickassTorrents

Summary

KickassTorrents experienced significant downtime caused by a DDoS attack targeting its DNS servers, rendering the site and all official proxies inaccessible globally. The attack, which had previously caused intermittent outages, disrupted services repeatedly despite recovery efforts, with ongoing instability reported even after temporary restoration of access.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 16, 2016, KickassTorrents (KAT), one of the world’s most visited torrent sites, became inaccessible to users globally due to a Distributed Denial of Service (DDoS) attack targeting its DNS infrastructure. The attack caused extended downtime, rendering the main domain and all official KAT proxy sites unreachable for several hours. KAT’s technical team confirmed the incident to TorrentFreak, attributing the disruption to a sustained assault on their DNS servers that overwhelmed their capacity to resolve legitimate user requests. This was not an isolated event, as similar DDoS activity had caused brief outages earlier in the same week, though the site had intermittently regained functionality before succumbing to renewed attacks. The operational impact was widespread, with no regional exceptions reported, affecting all users attempting to access KAT’s services during the attack window.

By January 17, 2016, KAT partially restored access for most users, though the DDoS campaign persisted intermittently, causing additional instability. The site’s operators prioritized mitigating the DNS-layer attack but faced ongoing challenges in maintaining consistent uptime as the offensive continued. No data breaches, defacements, or secondary compromises were reported in connection with the incident. The primary consequence remained service unavailability, disrupting file-sharing activities without evidence of data exfiltration or system infiltration. KAT’s public communications emphasized technical countermeasures against the DDoS traffic rather than attributing motives or identifying perpetrators. Service fluctuations persisted throughout January 17, reflecting the asymmetric nature of the attack against the site’s infrastructure defenses.

Sources

Sources available to members: 1 source.