Threema Hit by Persistent DDoS Attacks, Causing Widespread Service Disruptions Earlier this week, Threema, the Swiss-based end-to-end encrypted messaging service, suffered a series of large-scale distributed denial-of-service (DDoS) attacks that disrupted user communications. The attacks began on Tuesday around 6 PM UTC, with users reporting delays and connection issues. Initially, Threema attributed the outages to a network problem with its colocation partner, Nine, but later confirmed the disruptions were caused by ongoing DDoS attacks. The service, known for its privacy-focused features including no ads, profiling, or data analysis experienced intermittent outages across multiple regions, including Switzerland, India, and China. While Threema’s status page indicated normal operations, users continued to face connectivity problems into Wednesday. The company acknowledged that the attacks were unusually persistent, with threat actors constantly shifting tactics to bypass mitigation efforts. Threema’s on-premises customers, who rely on their own infrastructure, remained unaffected. However, business users of Threema Work were notified via email about the unstable conditions. The company noted that while DDoS attacks are typically mitigated with minimal impact, this incident proved challenging due to its scale and the attacker’s adaptive strategies. In response, Threema has implemented additional DDoS protection measures to filter malicious traffic upstream and reduce strain on its infrastructure. The company also clarified that it was unclear whether Threema was the primary target or if the attacks were part of a broader campaign against multiple services.