Pro-Iran Group Claims Responsibility for 24-Hour DDoS Attack on Bluesky

A coordinated distributed denial-of-service attack disrupted services on the Bluesky social media platform for 24 hours beginning April 15, 2026. The 313 Team, a hacking collective also known as Islamic Cyber Resistance in Iraq, claimed responsibility for the operation, citing pro-Iran geopolitical motivations aimed at creating disruption and amplifying regional tensions.

The attack rendered the decentralized platform inaccessible to users globally. Bluesky, which operates on a distributed network architecture, experienced significant service degradation throughout the day. The platform's infrastructure struggled to maintain connectivity as traffic volumes spiked beyond normal operational capacity. Users reported an inability to post content, access feeds, or log into accounts during the outage window.

The 313 Team has historically aligned with Iranian state interests and has targeted Western technology infrastructure in previous operations. This latest incident marks a significant escalation in the group's campaign against social media platforms. The group stated in a public release that the attack was intended to demonstrate vulnerability in decentralized systems and to protest perceived Western biases in digital spaces.

Bluesky's engineering teams worked to mitigate the impact of the attack throughout the day. The platform's distributed nature allowed for partial service restoration in some regions while other areas remained affected. By the 24-hour mark, services had stabilized, and normal operations resumed. The company has not yet released a detailed post-mortem analysis of the incident or confirmed the specific vectors used by the attackers.

The timing of the attack coincides with heightened geopolitical tensions in the Middle East. Analysts note that cyber operations targeting communication platforms often accompany periods of diplomatic friction. The 313 Team's involvement suggests a coordinated effort to leverage digital infrastructure as a tool of geopolitical influence.

Security experts are monitoring the situation for potential follow-up attacks. The success of the 24-hour disruption raises questions about the resilience of decentralized platforms against sustained cyber operations. Bluesky has not commented on whether additional security measures are being implemented or if the platform will undergo structural changes in response to the incident.

The incident highlights the growing intersection of cyber warfare and social media infrastructure. As decentralized platforms gain traction, they become increasingly attractive targets for state-aligned hacking groups. The 313 Team's claim of responsibility adds to a pattern of cyber operations attributed to pro-Iran actors targeting Western technology companies.

Questions remain regarding the full scope of the attack's impact and whether any data was compromised during the outage. Bluesky has not confirmed whether user information was accessed or if the attack involved more than service disruption. The platform continues to monitor its systems for signs of further intrusion or attempts to exploit vulnerabilities exposed during the incident.