Amnezia VPN has released a comprehensive account of the intense blocking campaign Russian authorities waged against its services this summer, detailing how the company restored stable operation of Amnezia Free and Amnezia Premium after repeated waves of sophisticated censorship.
Attack Overview
The campaign was not a conventional protocol block but a coordinated infrastructure attack. Operators observed targeted reconnaissance of the API, service behavior, and infrastructure logic, accompanied by DDoS attempts and direct attacks on the API. While the API itself resisted compromise thanks to prior audits, individual components were successfully flooded. The company also faced DDoS against its website; because it uses Amazon CloudFront, the 100k–500k RPS peaks were mitigated through rapid rate-limit activation by Amazon.
Roskomnadzor changed its blocking strategy. Instead of blocking protocols outright, censors now fingerprint traffic patterns, map servers receiving matching traffic, and automatically blacklist addresses and entire subnets. Blocks are rolled out sequentially rather than simultaneously, allowing the service to recover from one wave before the next set of rules is deployed.
Technical Mitigations Implemented
Amnezia closed several protocol fingerprints: zero-length UDP packets in certain clients, fixed-size keepalive packets, handshake timing artifacts, nonce zero bytes, and related infrastructure detection vectors. After multiple client updates, mass blocking of newly deployed servers largely ceased. Connections from outdated Amnezia Premium clients are now disabled. Self-hosted AmneziaWG installations were mostly unaffected by protocol-level rules, though some users still encountered subnet blocks.
Timeline of the Incident
The first wave began on the night of 20 May with numerous servers blocked alongside DDoS and apparent replay or scanning activity against AmneziaWG. Subsequent waves on 1 June, 7 July, 10 July, and 25 July combined IP blacklisting, subnet monitoring, API scanning, phishing attempts against staff, and automated detection of fresh servers within hours of deployment. The active phase lasted roughly six weeks.
Engineers discovered that AmneziaWG 1.0 and 1.5 versions were identifiable by fixed packet sequences following a predictable initial handshake. This prompted an accelerated rollout of AmneziaWG 2.0, which dropped support for Windows 7, Android 8, and certain router configurations. Additional fixes addressed keepalive packets and zero-length UDP packets on specific platforms.
Future Defenses and Infrastructure Changes
Work on AmneziaWG 3.0 is underway to eliminate remaining structural features such as packet-size sequences, inter-packet timing, post-handshake behavior, and repeatable combinations that allow cumulative scoring. The company is also doubling server capacity for its VLESS infrastructure to provide resilient fallback connectivity that survives both protocol and IP-based blocking.
