DDoSia

DDoSia is a custom distributed denial-of-service platform associated with the pro-Russian hacktivist group NoName057(16) and active since 2022. It was developed to enable large-scale, coordinated denial-of-service operations through a volunteer participation model rather than relying solely on a traditional botnet of compromised hosts. Supporters are recruited primarily through Telegram, where operators distribute instructions, target updates, public claims of responsibility, and gamified incentives including leaderboards and cryptocurrency-based rewards for top contributors.

The platform is designed to lower the barrier to participation for minimally skilled users. Volunteers authenticate through a Telegram-based registration workflow, receive a client identifier, and run the DDoSia client on their own systems. The client contacts command-and-control infrastructure to retrieve target lists and attack parameters, historically over HTTP and in later iterations with encrypted communications. Reported implementations have included Python and Go variants, with Go-based builds improving portability and performance across multiple operating systems.

DDoSia supports multi-vector denial-of-service activity at both the application and transport layers. Documented modes include HTTP and HTTP/2 request flooding, slow-connection attacks resembling Slowloris behavior, and TCP flooding including SYN-based attacks. Campaign reporting consistently shows heavy targeting of web services, especially HTTPS endpoints, though other internet-facing services have also been targeted. The malware reports operational statistics back to its infrastructure, allowing operators to measure participant effectiveness and administer reward schemes.

The platform has been used extensively in politically motivated campaigns against Ukraine, NATO member states, and other countries or organizations perceived as supporting Ukraine. Observed targets have included government agencies, public administrations, financial institutions, transportation and logistics organizations, media, defense-related entities, ports, railways, and other critical infrastructure. Activity often aligns with geopolitical events, elections, diplomatic visits, military aid announcements, and major international gatherings, reflecting its role as both a disruptive and propaganda-amplifying tool.

Multiple public assessments and legal actions have linked DDoSia and the broader NoName057(16) project to Russian state-aligned interests. U.S. and partner government reporting has described NoName057(16) as a covert project tied to CISM, with allegations that personnel developed and customized DDoSia, funded infrastructure, administered communications channels, and selected targets. DDoSia is also widely described as the successor to the earlier Bobik-enabled DDoS ecosystem used by the same collective.