Rostelecom BGP Hijack Diverts Akamai, Cloudflare and AWS Prefixes
On 1 April 2020 at about 19:28 UTC, Russian operator Rostelecom (AS12389) announced roughly 8,800 prefixes belonging to about 200 networks, including Akamai, Cloudflare, Amazon AWS, Hetzner and DigitalOcean, for about an hour.
02Deep-Dive Technical Analysis
Many announcements were more-specific routes (e.g. a /21 inside Cloudflare's /20), which BGP longest-prefix matching prefers over legitimate covering routes. They propagated via Rascom (AS20764) to Cogent (AS174) and Level3 (AS3356) within minutes and on to much of the Internet, pulling affected traffic toward Rostelecom. ThousandEyes and others judged the pattern consistent with an internal BGP optimizer leaking routes, and Rostelecom said an internal traffic-balancing system exposed incorrect routes. Whether it was purely accidental remains disputed, given Rostelecom's earlier 2017 leak of financial-institution prefixes.
03Vulnerability & Exploit Flow
Leaked more-specific prefix announcements accepted by upstream transit providers without adequate prefix or origin filtering.
04Recommended Defense & Mitigation Protocol
RPKI ROAs with maxLength, Route Origin Validation at transit providers, IRR-based customer prefix filters and peer-lock (MANRS).
05Security Impact & Geopolitical Consequence
Highlighted that one large carrier's leak can divert or blackhole CDN and cloud traffic worldwide, boosting RPKI Route Origin Validation and MANRS filtering among transit providers.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.