This summer we faced the largest series of blocks in the project’s history. Several consecutive waves disrupted Amnezia Free and Amnezia Premium for users in Russia.
We’ve already covered the ways censorship works in the Russian Federation
Still, the tightening of internet restrictions is a global trend — we’ve been following it for quite a while now. We believe that our findings and experience may spur the development of countermeasures across the globe. Thus, we’d love to share our observations.
In this article, we explain what exactly was happening, step by step, as well as why recovery took longer than we expected, and what we’ve already changed.
As of publication:
- We’ve stabilized Amnezia Premium — it’s available with the Amnezia VPN 5.0.1.5 app and newer.
- We’ve restored Amnezia Free in Russia and are again issuing config files for use on outdated devices (except for routers).
- What’s more, we’ve released the updated AmneziaWG 3.1 protocol, which bypasses blocking more effectively.
Let’s dive in.
TL;DR
- In the summer of 2026, Amnezia VPN lived through the largest series of blocks and DDoS attacks in Russia in the project’s history; the active phase lasted about a month and a half.
- The attack was hybrid: IP and subnet blocking, DDoS, API probing, rapid detection of new servers, phishing against the team, and analysis of AmneziaWG traffic. Against this backdrop, the usual recovery methods didn’t always work.
- What the team did: a series of client updates (up to 5.0.1.5), disabling old versions and some configurations for the sake of the service’s resilience, rebuilding the infrastructure, and putting the AmneziaWG and VLESS protocols to work.
- Amnezia Premium already works for most users (version 5.0.1.5 is needed; if there are failures, switch between AmneziaWG and VLESS); Amnezia Free took a bit longer to restore because of the scale of the service (more than a million active users in Russia).
- Amnezia Premium subscribers were credited with compensation for the disruptions several times.
- In early August, a new wave hit dozens of VPN services, but Amnezia Premium held — the service built up immunity to future attacks.
What Happened
The first problems began on May 20. We ran into massive blocking of server addresses, and then DDoS attacksDistributed Denial of Service — an attack in which the target resource is overloaded with requests on individual parts of the infrastructure.
At first we replaced blocked servers, spun up new ones, and redirected users. But on June 1 it became clear that someone was trying to deliberately “switch us off,” using a new combination of already familiar tactics. The attackers simultaneously:
- blocked IP addresses and entire subnets,
- subjected our services and site to DDoS attacks,
- probed the API and the structure of the infrastructure using automated systems,
- found and blocked new servers within a few hours of launch,
- ran phishing attacksPhishing is a type of cyberattack that relies on the trust of users in a target organization against team members,
- studied the technical features of AmneziaWG 2.0 traffic.
As a result, Amnezia Free and Amnezia Premium worked with interruptions for users in Russia.
We recorded the next wave on July 7, and on July 10 we released an update, which was followed by another barrage of blocks. The last wave as of publication came on July 25.
The active phase of the incident ran for a month and a half
Why It Happened
Blocking of VPN services has changed — we can see that VPNs are being studied deliberately, and that there are attempts to switch them off. Several methods are used for this; sometimes at once, sometimes in sequence, as the service recovers from the previous wave.
Large VPN services become a target of their own
By our assessment, Amnezia VPN had been studied long before the June attack. Data about the service’s operation, traffic features, and server infrastructure — including the IP addresses of our nodes — was probably collected in advance.
This made it possible to strike a large part of the infrastructure all at once, so that a quick recovery by replacing a few servers was impossible. This is how we explain both the scale of the initial strike and why full recovery took considerably longer than with previous blocks.
How We Fended Off the Attack: What Worked and What Didn’t
The attackers took a comprehensive approach to the task, so traditional recovery methods didn’t always work. Here are just some of the measures we took — with varying degrees of success.
Why Replacing Servers Didn’t Help
As a rule, a blocked VPN server is replaced by a backup one. This time, new addresses came under restrictions within the first hours after launch.
We spun up additional nodes, redistributed users, and expanded the infrastructure. But endlessly swapping servers is pointless. The more users connected to a new node, the faster the data for detecting and blocking it piled up.
We had to work out how the censors were pinpointing us again and again.
Why We Updated the Client Several Times
Alongside restoring the service, we were investigating the incident. Each wave brought fresh data — and sometimes changed the picture.
From the outside it looked like this: first you have to install one version, then the next, and a few days later a third. We understand how annoying this was, especially when yet another update didn’t guarantee stable operation. But each version solved part of the problem.
Some hypotheses weren’t borne out, and some solutions gave only a temporary effect. Haste once led to a release in which the VLESS protocol was unavailable on some platforms. But we kept checking the causes, shipping fixes, and bringing the service back online.
In July the blocking rules changed, and the attack continued. In response, we released AmneziaVPN 5.0.1.5, updated how the protocols work, and returned to rebuilding the infrastructure.
Why We Disabled Older Versions
An outdated client could give away a shared server. Blocking that server cut off access for all users on the node, with no exceptions. Given this, we restricted connections to Amnezia Premium infrastructure through old versions of the app.
In essence, we introduced a digital quarantine — restricting access for some users to protect the service as a whole
It was a hard decision, but the current version of the client not only provides a stable connection but also determines the resilience of the whole service. That’s exactly why we urge users to update as often as possible.
Why Switching to VLESS Didn’t Always Help
On some servers, AmneziaWG and VLESS ran on the same IP address. We expected that if there were problems with one protocol, users could switch to the other. But blocking by server address closes access to both.
VLESS still makes it possible to quickly restore access. At the same time, we continue to develop AmneziaWG — our own technology — in the new blocking environment.
Why Config Files Stopped Working
Config files work on a more rigid connection scheme and are harder to update on the fly than a connection through the app.
Under the new conditions this became a problem: as with outdated client versions, the configurations exposed servers and led to those servers being blocked. So some active configurations had to be temporarily disabled, and the mechanism itself reworked to account for the new detection rules.
Why Restoring Amnezia Free Took Longer
In short, Amnezia Free is larger in scale than Amnezia Premium.
In Russia alone, more than a million people use Amnezia Free. That’s more than the population of Lisbon, Amsterdam, or Athens
That volume requires an extensive server infrastructure, and new waves of blocking require regular replacement of many nodes. This is technically difficult and expensive, and the resources of an independent project don’t compare to the capabilities of the censors.
So we restored Free, but gradually — in a way that makes the infrastructure more resilient to the next wave.
On Compensation
We compensated Premium users for the time of unstable operation several times:
- After the initial incident, on May 21, all affected subscribers got an extra 14 days.
- Then, on June 15, users with a six-month subscription got one more month, and those with an annual one — two months. We also credited bonus days to those whose subscription ended during the incident.
- And a little later, we credited an extra month or a month and a half to all users, even if the blocking didn’t affect them.
In total, subscribers got from one and a half to three months of free access to Amnezia Premium.
What Works Now
Amnezia Premium is available for most users with the current version of the app. Depending on the region, provider, and network type, individual locations or protocols may still run into some issues. In that case, it’s worth switching from AmneziaWG to VLESS or the other way around.
In parallel, we’ve:
- Restored Amnezia Free in Russia.
- Resumed the operation of configurations on Android TV-based televisions and set-top boxes. We don’t guarantee operation on routers — as of publication, it all depends on the specific manufacturers, and we’re waiting for their cooperation.
- Brought the “Russia” location back to Amnezia Premium.
Next, we’ll refine support for old devices and operating systems. All of this in parallel with expanding the server infrastructure.
The main task is to bring back Amnezia VPN’s usual simplicity without losing the resilience we gained by rebuilding the service
What Users Should Do
Amnezia Premium users need to update the app to version 5.0.1.5 or newer.
We also publish instructions for solving common problems on our resources:
- in the technical documentation,
- on the blog,
- in our communities — Telegram, Discord, Reddit, and X (Twitter).
What’s Next
June and July were the hardest period for Amnezia VPN in our entire history. But they also showed that the team can quickly break down new blocking mechanisms, test hypotheses, and rebuild infrastructure under constant pressure.
The hit of this summer, though, was a rumor that Amnezia VPN had supposedly stopped working because it “made a deal with Roskomnadzor.” Just in case: this isn’t true. You can’t make a deal with Roskomnadzor. You can’t reason with it. It doesn’t feel pity, or remorse, or fear. And it absolutely will not stop, ever...
We can’t promise there won’t be new blocks: censors constantly update their methods, and how a VPN works depends in part on the specific network and operator. But the overall blocking environment has changed.
In August, another wave of restrictions swept over dozens of VPN services — Amnezia Premium held. We believe the current version of the client and the protocol implementation cope better with the new hybrid attacks.
As of publication, Premium works for most users. In parallel, we’re restoring Amnezia Free, developing our own technology, and preparing the service for the next waves of blocking.
That said, connection quality still depends on the region, the operator, and specific settings. We’ve put together materials on why VPN services may not work at all.
Amnezia VPN was built to work in a hostile environment. Now we’re better prepared for that environment to keep changing, and we’ll keep working where others give up.
We continue to investigate how internet censorship and blocking mechanisms evolve.
If you notice new blocking patterns or features or how the censorship works overall in your region, send it to us at hello@amnezia.org.
We guarantee full anonymity
2 min
