Bluesky Hit Twice by Iran-Linked Hackers: ATProto API Is DDoS Soft Target

Bluesky confirmed Monday that a distributed denial-of-service (DDoS) attack had flooded its servers with junk traffic for roughly 24 hours — the second time in four months the platform was knocked offline by a campaign linked to the same Iran-aligned hacktivist group. TechCrunch reported the incident Monday after Bluesky published its statement. For the 44 million-plus registered users who depend on the platform as an alternative to X, the disruption was more than an inconvenience — it was a demonstration of an architectural vulnerability that Bluesky's "decentralized" branding has never fully resolved.

The disruption began Sunday, August 17, with users reporting intermittent failures across the platform. By Monday morning, the outage had widened: feeds stopped refreshing, notifications went dark, threads failed to load, and became unavailable entirely. TechCrunch confirmed Bluesky acknowledged the attack on Monday , stating the assault had been underway for the 24 hours.

"We have upgraded our defenses in response, and we continue to monitor the situation," Bluesky said in its official post , offering no technical specifics the attack volume, vectors, or what "upgraded" means in practice. The company said it found no evidence of unauthorized access to private user data — an important distinction: DDoS attacks are designed to overwhelm and disable infrastructure through traffic volume, not to infiltrate systems or exfiltrate records.

Bluesky itself declined to speculate on attribution. Security researchers in the public Internet Freedom & Infrastructure Network (IFIN) forum identified the responsible party differently: the 313 Team, also known as the "Islamic Cyber Resistance in Iraq," posted a claim of credit on its Telegram channel describing the operation as a targeted assault on Bluesky's API. TechCrunch reported the 313 Team responsibility claim from the IFIN forum.

The 313 Team is an Iraq-based, pro-Iranian hacktivist collective that cybersecurity firms have assessed as having MOIS ties to Iran's Ministry of Intelligence and Security (MOIS), though that connection is assessed rather than proven. The group, founded in December 2023 in the wake of the October 7 Hamas attacks, part of pro-Iran hacktivist coalition hacktivist coalition and coordinates its operations exclusively through Telegram channels.

SecurityWeek, which covered the group's April 2026 Bluesky attack in detail, noted that groups of this kind are "often a persona used by government agencies" and have "been known to make exaggerated or false claims ." During the April incident, the group announced the attack would last three hours. It lasted approximately 24 hours .

The 313 Team's target list has expanded steadily across 2026: beyond two attacks on Bluesky, the group has claimed operations across multiple platforms against the Internet Archive, Microsoft, X, Truth Social, Canonical's Ubuntu infrastructure (accompanied by extortion demands), and government portals in Bahrain and Kuwait. Pro-Iran hacktivist operations across this period show none of those operations produced the data exfiltration or system compromise that state- intrusion campaigns typically aim for — the goal appears to be visibility and disruption, not espionage.

The most revealing comparison from both incidents is not what the 313 Team did — it is what happened when they hit Mastodon's flagship server, mastodon.social, roughly four days after the April Bluesky attack. Heise Online reported that mastodon.social impact was negligible . Users on other Mastodon instances — mastodon.online, fosstodon.org, and thousands of others — were unaware the attack had even occurred, because those instances run entirely independent infrastructure. The attack on mastodon.social could not reach them.

The reason comes down to a specific architectural choice that the two platforms made differently.

Mastodon runs on ActivityPub, the W3C federated protocol became 2018 standard . Under ActivityPub, each Mastodon instance is an independent server with its own infrastructure, its own API, and its own attack surface. If one instance goes down, every other instance continues operating. Federation is structural: distributed by design, not by aspiration.

Bluesky's AT Protocol (ATProto) was built around a different model. ATProto separates identity storage (Personal Data Servers, or PDSs), data aggregation (a centralized Relay that ingests all PDSs into a single firehose), and user-facing applications (an AppView that reads from the Relay). The official AT Protocol documentation describes how anyone can in theory run their own Relay or AppView, making the system portable and open. In practice, as of this writing, the vast majority of Bluesky's 44 million-plus users connect through Bluesky Social PBC's centralized Relay and official AppView at bsky.network and bsky.app.

That centralization is the specific vulnerability the 313 Team exploited. Flooding Bluesky's API endpoint — the connection between the Relay and the AppView — effectively cuts off the user-facing experience for virtually all users simultaneously, even though the underlying PDS data is never compromised or deleted. The attack is not a breach; it is a roadblock on the single highway nearly every Bluesky user must travel.

Bluesky has been building toward genuine federation. In January 2026, the company announced Relay transition toward independence , moving toward a model where third parties can operate Relay infrastructure independently. Independent projects like Blacksky, run by developer Rudy Fraser, have built their own Relay infrastructure at atproto.africa. But this transition is ongoing, not complete — and it did not protect the platform from two full-day outages in four months.

Bluesky's stated response — "we have upgraded our defenses" — is the answer a company can give after a volumetric DDoS. What it means technically depends on what those defenses are: additional CDN scrubbing capacity, expanded rate limiting at the API layer, BGP-based traffic rerouting, or some combination. Bluesky has not said.

What the architecture makes clear is that any of those measures, however effective, are still defending a centralized target. That is a fundamentally different security posture from what genuine federation provides. A DDoS mitigation vendor can absorb a flood at the edge; it cannot change the fact that Bluesky's user-facing experience runs through a single Relay that serves nearly every active user simultaneously. As Cloudflare's H1 2026 DDoS Threat Report noted, hyper-volumetric attacks surged 519% quarter-over-quarter in the first half of this year, and the window for human intervention during a sustained attack is effectively zero. A vendor can absorb the flood; only architecture can distribute the target.

The 313 Team's claimed traffic figure for the April attack — "1 terabyte per second" — has not been independently verified, and security analysts note the group routinely overstates the scale of its operations. What is verified is the result: 24 hours of disruption to 44 million-plus users, twice.

The 313 Team's campaign against Bluesky is not an isolated curiosity. It is one thread in a sharply escalating pattern of Iranian-aligned cyber operations against U.S. businesses and infrastructure that began when US-Israel launched coordinated February strikes against Iran on February 28, 2026.

U.S. government officials warned in July 2026 that Iranian-linked hackers were actively disrupting American water and energy providers, with Iran-linked group CyberAv3ngers attributed by Tenable to attacks on more than 30 Minnesota water facilities in late July. TechCrunch reported on Iranian hackers targeting water and energy providers across the U.S. A separate Iran-aligned group claimed a March 2026 attack on medical device manufacturer Stryker — TechCrunch confirmed Handala claimed the Stryker cyberattack in March. CISA updated its advisory on Iranian hackers targeting programmable logic controllers at water and energy facilities in July 2026.

The targeting of social media platforms fits a specific strategic logic within this campaign: disrupting the American digital public square generates visibility for the group, tests Western platform resilience, signals capability to domestic Iranian audiences during a period when Iran's own internet remained under severe government-imposed restrictions, and produces measurable disruption with relatively modest technical resources. CSIS analysis confirmed Iran's cyber strategy sows fear as psychological effect, not genuine escalation. Knocking a prominent American alternative social platform offline twice — for a full day each time — accomplishes all of those objectives at once.

The attack did not require sophisticated tradecraft. It required sustained traffic volume against a centralized API endpoint. That, more than anything else these incidents, is the detail Bluesky's engineering teams will need to grapple with.

Bluesky has said there was no unauthorized access to private user data in either attack. If you use Bluesky, your posts, follows, and direct messages were not exfiltrated. What happened was an availability failure — the platform was unreachable, not infiltrated.

For users who rely on Bluesky for professional communication, journalism, or research, the two 24-hour outages in four months are a practical signal: the platform is not yet resilient against sustained, state-linked DDoS campaigns. Whether Bluesky's architectural federation matures fast enough to change that calculus depends on how quickly independent Relay and AppView operators join the network and how many active users shift to clients built on that independent infrastructure.

The open-protocol model Bluesky is building toward could, in principle, produce the same resilience Mastodon demonstrated in April. Whether it gets there before a third attack tests that progress is the open question.

Both platforms use open, federated social networking protocols — but the architecture differs in a critical way. Mastodon uses ActivityPub, where each instance (mastodon.social, fosstodon.org, etc.) runs entirely independent infrastructure. An attack on one instance cannot reach others. Bluesky's AT Protocol centralizes aggregation through a Relay that serves the vast majority of users, making the API endpoint a single point of failure that affects nearly all users simultaneously when it is overwhelmed. The ActivityPub vs ATProto architectural comparison by Fediview (April 2026) confirms this structural distinction.

The 313 Team — also called "Islamic Cyber Resistance in Iraq" — is an Iraq-based hacktivist collective that has been active since December 2023. Cybersecurity firms including HawkEye and Palo Alto's Unit 42 assess the group has MOIS ties assessed rather than proven to Iran's Ministry of Intelligence and Security (MOIS), but that connection is assessed rather than publicly proven. The group operates exclusively through Telegram and has targeted government portals, commercial platforms, and open-source infrastructure across dozens of countries in 2026. Security analysts note it routinely overstates the scale and impact of its operations.

Bluesky has not specified what defenses it upgraded after the August attack. Common DDoS mitigations include adding scrubbing-center capacity (routing traffic through a service that filters attack traffic before it reaches origin servers), expanding rate limiting at the API layer, or implementing BGP-based traffic rerouting during attacks. Any of these can reduce impact from a given attack. But as long as Bluesky's user-facing application runs through a single centralized Relay serving virtually all users, the architectural vulnerability remains: defenses protect the target; only federation distributes it. Cloudflare's H1 2026 DDoS Threat Report notes that hyper-volumetric attacks surged 519% quarter-over-quarter in early 2026, underscoring the scale of what centralized platforms must defend against.

No. Bluesky confirmed in both the April and August 2026 incidents that there was no evidence of unauthorized access to private user data. TechCrunch's August 2026 DDoS report and SecurityWeek's April 2026 coverage both confirm Bluesky's data-safety assurances. DDoS attacks are availability attacks — they overwhelm a service with traffic to make it unreachable, not to infiltrate systems or copy data. Your posts, follows, and messages were not accessed or exfiltrated during either incident.