DDoS-type cyberattack against the National Electoral Council (CNE) websites during the June 28 presidential election
Team Cymru observed a traffic spike consistent with a DDoS attack against the IP address hosting the CNE portals (SAFE/SICOFPE) for approximately 34 minutes on July 28, 2024. The analysis does not support the alleged hacking of the vote count or the official attribution to North Macedonia; the confirmed impact is the unavailability of the portals.
Impact details
DDoS traffic affected the CNE’s access portals for approximately 34 minutes. There is no technical evidence of any data breach, vote-count manipulation, or an attack originating from Macedonia.
Classification & severity
- Category
- Availability
- Subtype
- Distributed denial of service
- Confidence
- High
The Cymru team observed traffic similar to a DDoS attack directed at the CNE’s access portals; there is no technical evidence that the vote count was manipulated.
Severity assessment
High- Functional impact
- Degraded (non-critical)
- Information impact
- None
- Affected scope
- National
- Critical service
- Degraded
- Public confidence
- Significant
- Recoverability
- Regular
The impact on availability on Election Day is technically justified; the alleged compromise of the voting system is not.
Timeline
On Election Day, the CNE’s websites became inaccessible; the government attributed the outage to a “cyberattack from North Macedonia” to justify the delay in reporting the results.
Team Cymru documented a DDoS-type traffic spike lasting about 34 minutes (11:29–12:03 local time) targeting the IP address 201.130.83.39, which hosts the SAFE and SICOFPE portals, involving nearly 6,000 IP addresses from 110 countries.
The hacktivist ASTRA (linked to Cyber Hunters) publicly claimed to have overwhelmed the CNE’s ports, alleging that the software had not been updated since 2022 and framing the attack as part of plans to destabilize the Maduro government.
Fact-checkers (Fake News Hunters) conclude that there is no technical evidence to support the alleged hacking of the results transmission system or the attribution to North Macedonia; they note that the site went offline due to the deletion of the CNE’s own DNS record.