After Bluesky, Mastodon Targeted in DDoS Attack

Following a similar assault on Bluesky just days prior, the decentralized social media platform Mastodon has also been targeted in a major distributed denial-of-service (DDoS) attack.  The attack targeted Mastodon.social, the flagship Mastodon server, and caused what the organization classified as a ‘major outage’. According to the Mastodon status page, the DDoS attack started on April 20 at around 1 PM, and by 4 PM mitigations were rolled out and the site became accessible. An update shared on April 21 at 11 AM showed that the attack stopped and operations had returned to normal.  The DDoS attack came just days after Bluesky, a similar social media platform, was disrupted by what it described as a sophisticated attack. A threat actor called 313 Team, which claims to be a pro-Iran hacktivist group, took responsibility for the attack, but their claims have not been verified.  No one appears to have taken credit publicly for the attack on Mastodon.  Both Mastodon and Bluesky surged in popularity following Elon Musk’s acquisition of X (formerly Twitter), positioning themselves as decentralized refuges from top-down control, unpredictable algorithms, and erratic moderation. Related: Critical Vulnerability Can Allow Takeover of Mastodon Servers Related: 53 DDoS Domains Taken Down by Law Enforcement Related: German Rail Giant Deutsche Bahn Hit by Large-Scale DDoS Attack WRITTEN BY Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. More from Eduard Kovacs Third US Security Expert Admits Helping Ransomware Gang Unsecured Perforce Servers Expose Sensitive Data From Major Orgs Data Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000 Serial-to-IP Converter Flaws Expose OT and Healthcare Systems to Hacking Bluesky Disrupted by Sophisticated DDoS Attack Next.js Creator Vercel Hacked Another DraftKings Hacker Sentenced to Prison Recent Apache ActiveMQ Vulnerability Exploited in the Wild Latest News Most Serious Cyberattacks Against the UK Now From Russia, Iran and China, Cyber Chief Says New Wiper Malware Targeted Venezuelan Energy Sector Prior to US Intervention  Mirai Botnet Targets Flaw in Discontinued D-Link Routers Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM Data Claude Mythos Finds 271 Firefox Vulnerabilities North Korean Hackers Use AppleScript, ClickFix in Fresh macOS Attacks Google Antigravity in Crosshairs of Security Researchers, Cybercriminals Oracle Patches 450 Vulnerabilities With April 2026 CPU Trending Webinar: A Step-By-Step Approach To AI Governance April 28, 2026 With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment. Register Virtual Event: Threat Detection And Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register People on the Move Anti-ransomware platform Halcyon has named Kirstjen Nielsen and Chris Inglis as Strategic Advisors. ThreatModeler has appointed Kevin Gallagher as Chief Executive Officer. Thomas Bain has been appointed Chief Marketing Officer at Silent Push. More People On The Move Expert Insights Government Can’t Win The Cyber War Without The Private Sector Securing national resilience now depends on faster, deeper partnerships with the private sector. (Steve Durbin) The Hidden ROI Of Visibility: Better Decisions, Better Behavior, Better Security Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. (Joshua Goldfarb) The New Rules Of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons From OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) Flipboard Reddit Whatsapp Email