{"id":5107,"date":"2026-10-07T08:23:24","date_gmt":"2026-10-07T08:23:24","guid":{"rendered":"https:\/\/cyberasia.io\/?p=5107"},"modified":"2026-10-07T08:23:32","modified_gmt":"2026-10-07T08:23:32","slug":"server-killers-us-government-sites-down","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/ddos\/server-killers-us-government-sites-down\/","title":{"rendered":"Server Killers: Revealed, 3 U.S. Government Sites Down"},"content":{"rendered":"\n

Server Killers announced attacks on three United States government sites<\/mark><\/strong> on Thursday (17 September 2026), and check-host reports show that all three sites failed to open from nearly all of the visible monitoring nodes. The named sites are Science.gov, OSTI.gov, which belongs to the Department of Energy (DOE), and EFTPS.gov, the federal tax payment system under the Department of the Treasury.<\/p>\n\n\n\n

The numbers are clear-cut. Of the 117 check results fully visible across the three reports, only one answered with a 200 (OK) code: the Vancouver, Canada node for EFTPS, with a response time of 6.49 seconds. All the rest recorded Connection timed out, including two nodes in Jakarta.<\/p>\n\n\n\n

\"Figure
Figure 1 : Server Killers logo with a hooded silhouette, a binary-code shield, and the Russian flag<\/figcaption><\/figure>\n\n\n\n

Sequence of Disruptions from EFTPS to OSTI<\/h2>\n\n\n\n

EFTPS was checked first. The check-host report for www.eftps.gov\/eftps\/ was recorded on Thursday 17 September 2026 at 14:10 UTC, equivalent to 21:10 WIB (Western Indonesia Time). This free Department of the Treasury service is used to pay federal taxes online, from income tax and employment tax to excise tax.<\/p>\n\n\n\n

In a browser, the EFTPS page displays ERR_CONNECTION_CLOSED<\/mark><\/strong>, meaning the connection was abruptly closed from the server side. Check-host recorded Connection timed out at 40 of the 41 fully visible nodes, from Vienna, S\u00e3o Paulo, and Tokyo to Singapore and Stockholm. Only Vancouver got through.<\/p>\n\n\n\n

\"Figure
Figure 2 : Server Killers and the EFTPS.gov disruption, check-host records only Vancouver responding with 200 (OK)<\/figcaption><\/figure>\n\n\n\n

About 44 minutes later, at 14:54 UTC (21:54 WIB), it was Science.gov’s turn. The Server Killers post for this site carries the note Duration: 1 hour and the hashtag #ServerKillers<\/mark><\/strong>. All 39 monitoring nodes in the screenshot recorded Connection timed out.<\/p>\n\n\n\n

\"Figure
Figure 3 : Server Killers and the Science.gov disruption, all check-host nodes record Connection timed out<\/figcaption><\/figure>\n\n\n\n

The last report, for OSTI.gov, was recorded at 17:57 UTC, or 00:57 WIB on Friday 18 September. OSTI is the DOE office that collects, stores, and opens public access to scientific information from DOE-funded research. In its post, the group wrote “Full Infrastructure is strongly downed”, then linked a separate page whose title names some of the affected domains.<\/p>\n\n\n\n

The result was the same: of the 37 fully visible nodes, every one failed to connect within the time limit. The two targets are also related, because the official DOE page lists Science.gov<\/mark><\/a><\/strong> as one of the resources managed by OSTI.<\/p>\n\n\n\n

\"Figure
Figure 4 : Server Killers and the disruption of OSTI.gov, owned by the U.S. Department of Energy, on 17 September 2026<\/figcaption><\/figure>\n\n\n\n

Who Is Server Killers and What Is Its Attack Pattern<\/h2>\n\n\n\n

The Server Killers logo combines a hooded silhouette, an orange shield over a binary-code background, Saint Basil’s Cathedral, and the Russian flag. Target descriptions are written in English, and some posts come with a Russian translation. The group’s location and number of members cannot be confirmed from the available evidence.<\/p>\n\n\n\n

Threat intelligence firm Cyjax<\/mark><\/a><\/strong> notes that Server Killers has been active since at least early August 2023, focuses on DDoS attacks, and frequently targets Ukraine and the countries that support it. Its latest campaign targets Norway: as of 8 September 2026, 36 targets had been announced, accompanied by check-host links, some stating durations of between one and five hours.<\/p>\n\n\n\n

ZeroFox<\/mark><\/a><\/strong> adds that the group announced attacks on the United Kingdom, Poland, and Denmark, then on Spanish government sites in February 2026. The Server Killers posts about these three U.S. sites do not state any motive or demand.<\/p>\n\n\n\n

The Server Killers channel has a small reach. According to Cyjax, its new channel had only 112 subscribers in early September 2026, consistent with the 56, 44, and 58 views on the three posts we reviewed.<\/p>\n\n\n\n

For context on similar DDoS attacks, also read https:\/\/cyberasia.io\/articles\/<\/mark><\/strong><\/a><\/p>\n\n\n\n

How to Read Check-Host Results<\/h2>\n\n\n\n

Check-host tests a single address from many locations at once. Connection timed out means the server did not respond within the time limit, while OK with a 200 code means the page opened normally. This report is a snapshot of a single moment, not a record of how long the disruption lasted.<\/p>\n\n\n\n

Some things are not visible. The screenshots do not include HTTP codes such as 502, 504, or 429<\/mark><\/strong>, so the attack vector cannot yet be determined: an HTTP request flood at layer 7 and a packet flood at the network layer can both produce this pattern. The only duration information, one hour for Science.gov<\/mark><\/strong>, comes from Server Killers itself.<\/p>\n\n\n\n

The list of monitoring nodes is also cut off in the middle of the alphabet, so results from locations in the United States do not appear. That matters, because the main users of all three sites are there. Simultaneous failures from Europe, Brazil, Japan, and Indonesia signal a widespread problem, but filtering of international traffic by the site operators cannot yet be ruled out as an explanation.<\/p>\n\n\n\n

Impact on Public Services and Tax Payments<\/h2>\n\n\n\n

The evidence posted by Server Killers shows only an availability disruption, not a breach. The material reviewed contains no data samples, credential lists, or signs of access to internal systems.<\/p>\n\n\n\n

EFTPS is the most sensitive because it involves tax obligations. The Bureau of the Fiscal Service<\/mark><\/a><\/strong> under the Department of the Treasury states that taxpayers can pay through the eftps.gov site, by phone, or through intermediaries such as tax professionals, payroll services, and financial institutions. The phone and intermediary routes serve as backups when the online site is hard to open.<\/p>\n\n\n\n

The case is different for Science.gov and OSTI.gov. Both are research access portals, so what is disrupted is access to scientific literature for researchers, students, and the public, not the operation of vital services.<\/p>\n\n\n\n

For readers in Indonesia, two Jakarta monitoring nodes recorded the same failure in all three reports, so access from inside the country was likely disrupted as well at the time of each check.<\/p>\n\n\n\n

As of this writing, we found no official statement from any of the three agencies. Three things are worth monitoring: statements from the Department of the Treasury and DOE, when services recover, and whether Server Killers adds more U.S. targets after its wave against Norway.<\/p>\n\n\n\n

Emergency Steps for Admins Under DDoS Attack<\/h2>\n\n\n\n

The joint guidance from CISA, FBI, and MS-ISAC<\/mark><\/a><\/strong> urges organizations to understand the DDoS protection their internet and cloud providers already have before an attack arrives. For admins already hit by a traffic surge like this, the following order of work makes sense:<\/p>\n\n\n\n