Loading story…
NoName057(16) has been identified as a pro-Russian hacktivist group conducting distributed denial-of-service (DDoS) attacks against websites tied to governments, news agencies, military organizations, suppliers, telecommunications providers, transportation authorities, and financial institutions. The group’s operations have focused on Ukraine and countries supporting Ukraine, with reported targeting that includes Estonia, Lithuania, Norway, and Poland.
Reporting links the group to the Dosia/DDoSia malware family and describes an operation that has evolved through publicly documented infrastructure, targeting patterns, and campaign activity. The activity reflects a sustained disruptive effort aimed at public- and private-sector online services in European states aligned with Ukraine, reinforcing the group’s role as a persistent politically motivated DDoS threat.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
By 17:00 UTC on 25 January 2023, the Estonian subdomain targeted by NoName057(16) displayed a down-for-maintenance message, indicating observable service disruption during the attack window.
Team Cymru observed an attack against an Estonian Ministry of Finance subdomain begin at 07:00 UTC on 25 January 2023, matching the schedule exposed in the group's target list.
The report says it confirmed NoName057(16) attacks since the beginning of 2023 against entities with infrastructure in Czechia, Denmark, Estonia, Germany, Slovakia, and Slovenia.
According to Team Cymru, NoName057(16)'s current campaign coordination server at 31.13.195.87 became operational on 19 December 2022, with Dynamic DNS domains resolving to it for target retrieval.
Team Cymru states that the group's previous command-and-control server, 77.91.122.69, remained active until 16 December 2022 before later infrastructure changes.
Team Cymru reports that NoName057(16) has claimed repeated DDoS attacks against Ukraine, NATO countries, and organizations in government, finance, freight, and media since March 2022.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
malpedia.caad.fkie.fraunhofer.de
Open sourceorkl.eu
Open sourceteam-cymru.com
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Pro-Russian hacktivist group **NoName057(16)** intensified distributed denial-of-service attacks against government and private-sector targets across Europe, including Dutch public services disrupted around the NATO Summit in The Hague. Reported incidents in the Netherlands included attacks on municipal and provincial websites and an earlier strike on **Logius** that temporarily affected **DigiD** and access to services used by the **Belastingdienst**, **UWV**, **DUO**, and hospital portals. The group has also targeted organizations in Ukraine, Israel, and other European countries, often timing attacks to politically significant events and focusing on sectors such as government, transportation, banking, defense, media, and energy. The group’s operations relied on **Telegram** for propaganda, recruitment, and coordination, while the **DDoSia** platform distributed encrypted attack parameters to volunteers who could be rewarded with cryptocurrency. Reporting also linked the ecosystem to malware including **Bobik** and **RedLine Stealer**, which were used to support involuntary participation in attacks. An international law-enforcement action, **Operation Eastwood**, led by Europol and Eurojust, disrupted more than 100 servers tied to the network and resulted in arrests, warrants, and notifications to participants, dealing a significant blow to the group’s infrastructure even as its public claims were described as overstating real-world impact.
Jul 7, 2026
Pro-Russian hacktivist group NoName057(16) conducted a large-scale distributed denial-of-service (DDoS) campaign between December 8 and 14, 2025, primarily targeting organizations in Belgium and Ukraine. The campaign, orchestrated using the group's proprietary DDoSia tool, resulted in over 4,400 recorded attacks against 155 unique domains and 144 IP addresses, affecting both private sector infrastructure—such as telecommunications, utilities, and industrial organizations—and high-value government and defense-related services. The attacks also impacted European Union institutions and international organizations, highlighting the group's broad targeting scope and operational reach. NoName057(16) is a pro-Russian hacktivist collective with origins linked to the Kremlin-backed Centre for the Study and Network Monitoring of the Youth Environment (CISM). The group leverages Telegram for coordination and GitHub for tool distribution, and has expanded its influence through collaborations with other pro-Russian groups, including the Cyber Army of Russia Reborn (CARR). Their operations have increasingly focused on NATO member states and adversaries of Russian geopolitical interests, with the DDoSia tool serving as a central component in mobilizing and executing attacks against critical infrastructure and government entities across Europe.
Jun 29, 2026
SOCRadar reported a coordinated, multi-country **DDoS campaign** attributed to pro-Russian actor **NoName057(16)** using the **DDoSia** tool, with **5,830** recorded attack entries against **160 domains** and **181 IPs** during the Jan 26–Feb 1, 2026 analysis window. The activity showed broad geographic targeting, led by the **UK (55%)**, followed by **Ukraine (12.7%)** and **Czechia (4.9%)**, and focused heavily on public-sector and critical-service targets; the report also noted frequent target-list updates distributed via Telegram and that **port 443** was the most targeted. Separately, Polish authorities (CBCZ) arrested and then bailed a **20-year-old** suspected of running a multi-layered botnet used to DDoS “numerous popular websites,” including sites described as strategically important, using “C2 stresser” and command-and-control nodes; police seized equipment and claimed to have dismantled infrastructure used to host/distribute DDoS tools, with additional arrests possible. An NSFOCUS monthly report on **December 2025 APT activity** (e.g., TransparentTribe, Sidewinder, Konni, Gamaredon) describes broader spear-phishing-led intrusion trends and is not tied to the NoName057(16) DDoSia activity or the Polish DDoS case.
Jun 29, 2026