ConflictClarifier

متتبع أزمة إيران-الخليج 2026
CC
Events Archive
strikeMay 1, 2026

Canonical under sustained DDoS attack as Ubuntu 26 releases — Iranian group 313 Team claims responsibility

Summary

Canonical under sustained DDoS attack as Ubuntu 26 releases — Iranian group 313 Team claims responsibility Find your download mirrors here. The meatspace war with Iran has been spilling into cyberspace as well, and the latest casualty is Canonical. The company behind the ever-popular Ubuntu Linux is in a spot of bother, as the majority of its infrastructure is being hit by a Distributed Denial of Service (DDoS) attack. The attack has reportedly been claimed by Iranian ne'er-do-wells 313 Team, also known as the Islamic Cyber Resistance in Iraq. The attackers requested a virtual meeting with the Canonical staff under threat of continued attacks, but there have been no other public developments. The most obvious result is that Canonical's, er, canonical Ubuntu download and update mirrors worldwide are sluggish or down entirely, as is the main website. The attack extends to Launchpad, the Snap store, Canonical SSO, and other related services. Thankfully, there are no reports of security compromises affecting package repositories or ISO images, so whichever download spot you find should be safe. Intentionally or not, this attack comes hot on the heels of the release of Ubuntu 26 LTS, dubbed Resolute Raccoon. As its name and even version number imply, this is a release with an extended support window, meaning it'll be the one installed in servers and workstations worldwide.Article continues below Much like yours truly found out yesterday, you may find it difficult to get a hold of Ubuntu 26, package updates, or even the handy WSL2 image. The Linux community is large and spread out, though, so any one of the hundreds of the non-Canonical (pun intended) will suffice. You can find one of the mirrors in the list at launchpad.net; if that link fails to load, you can consult the version on the Wayback Machine here. If you have a torrent client handy, here are the links to the desktop x64 release and the live server x64 version. Some techies hypothesized that this attack could be related to the disastrous Copy Fail vulnerability, to which most distros, including the extant Ubuntu 24, are vulnerable. That premise is a little shaky, as in the grand scheme of things, just stopping people from updating Ubuntu isn't a world-ender, plus power users and competent sysadmins will apply a workaround or just find a mirror regardless. Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. Bruno Ferreira is a contributing writer for Tom's Hardware. He has decades of experience with PC hardware and assorted sundries, alongside a career as a developer. He's obsessed with detail and has a tendency to ramble on the topics he loves. When not doing that, he's usually playing games, or at live music shows and festivals.

Perspectives

Iranian Official

In defense of Iran's sovereignty against relentless Western cyber aggression and sanctions, the 313 Team has launched a targeted DDoS operation on Canonical's infrastructure. This act of resistance disrupts Ubuntu 26 download mirrors and related services without compromising data security, asserting the Islamic Republic's right to counter foreign threats in cyberspace.

Israeli

Iran's proxy network, including the 313 Team cyber unit, has launched a sustained DDoS assault on Canonical's global infrastructure coinciding with Ubuntu 26's release, disrupting critical download and update services as part of Tehran's broader campaign to undermine Western technological foundations. This attack exemplifies the Islamic Republic's existential threat posture, extending its hybrid warfare from physical proxies like Hezbollah to cyberspace in an effort to erode the digital resilience of open-source ecosystems vital to allied nations. Israel and its partners must prioritize layered cyber defenses to neutralize such Iranian aggression before it escalates to direct targeting of strategic assets.

Neutral

Canonical's infrastructure, including download mirrors, Launchpad, the Snap store, and related services, has experienced a DDoS attack coinciding with the release of Ubuntu 26 LTS. An Iranian group identifying as 313 Team has claimed responsibility and reportedly demanded a virtual meeting with Canonical staff. No security compromises to package repositories or ISO images have been reported.

Western

Canonical's core infrastructure faced a sustained DDoS campaign by Iranian actor 313 Team timed with the Ubuntu 26 LTS rollout, deliberately disrupting global mirrors, Launchpad, and Snap services to impair Western open-source distribution. The operation reflects Tehran's strategy of targeting allied technology ecosystems without altering package integrity. Effective countermeasures and hardened resilience remain essential to neutralize this persistent threat vector.

Pro-Peace

The DDoS assault on Canonical's servers by Iranian group 313 Team, unfolding against the backdrop of U.S.-Iran tensions, has crippled downloads and updates for Ubuntu 26, denying millions of users—especially students, researchers, and aid organizations in developing regions—reliable access to essential open-source tools. These spillover cyberattacks compound the human cost of geopolitical hostilities, disrupting livelihoods and services while civilian populations endure sanctions, displacement, and infrastructure strain on all sides. Renewed diplomatic engagement offers the only sustainable path to de-escalate such conflicts and spare noncombatants further digital and physical harm.

Global South

Iranian cyber resistance actors have struck Canonical’s Western-controlled infrastructure, disrupting Ubuntu downloads and services relied upon by servers and institutions across the Global South. The attack exposes the fragility of dependence on a UK-based platform whose centralised mirrors and repositories reflect ongoing neo-colonial patterns of technological control. Such incidents reveal the repeated failure of international bodies to curb cyber spillover from Western-Iranian confrontations, leaving sovereign states to assert digital autonomy through asymmetric means.

Actors involved

Iran

Sources

  • currentsapi(Mixed)By Bruno Ferreira

    Canonical under sustained DDoS attack as Ubuntu 26 releases — Iranian group 313 Team claims responsibility Find your download mirrors here. The meatspace war with Iran has been spilling into cyberspace as well, and the latest casualty is Canonical. The company behind the ever-pop

See this event through different lenses

Compare how Western, Iranian, Israeli, Global South, and Pro-Peace perspectives frame this event.

Compare Perspectives

Community Notes

Community Notes

Loading notes...

Related events

strikeUnverifiedUSIranRussiaChina
1 source

According to the semi-official Mehr News Agency, more than 3,700 cargo trucks are reportedly stalled at Iran’s borders with Turkey and Pakistan, with truckers alleging delays of up to 20 days amidst extreme heat and logistical shortages. Coinciding with a reported nearly 30% decline in non-oil exports to $15 billion, these trade disruptions occur against the backdrop of a US naval blockade of the Strait of Hormuz and recent cross-border attacks affecting Iraq-Saudi Arabia pipeline operations.

Location: Iran
strikeUnverifiedUSIranProxyUN
1 source

Pakistan’s Defence Minister stated that the country is prepared to activate the Mecca defence pact with Saudi Arabia and Turkey amid intensifying Houthi attacks on the kingdom. While Islamabad emphasized its commitment to protecting Saudi Arabia and its holy cities, Houthi officials disputed claims of targeting Mecca, asserting that their operations are limited to Saudi oil facilities and military bases.

Location: Mecca
strikeUnverifiedUSIsraelIranProxyChina
1 source

Analyst Mark Almond argues that Houthi drone strikes on Saudi Arabia’s East-West pipeline and Red Sea shipping routes pose a significant threat to global supply chains. While the Houthis state they are targeting only Saudi forces and their proxies, the article notes that confidence in this limitation is currently low.

Location: Strait of Hormuz
strikeUnverifiedUSIsraelIranUN
1 source

A UN fact-finding mission reported having reasonable grounds to believe U.S. forces conducted strikes on a school in Iran that officials said killed more than 150 people, while also alleging Iranian authorities committed crimes against humanity during recent protests.

The report is being submitted to the UN Human Rights Council, and while U.S. officials stated their operations complied with the law of armed conflict, Iran has rejected allegations of systematic rights violations.

Location: Iran