NoName057(16)

NoName057(16) is a pro-Russian hacktivist collective active since March 2022 that primarily conducts politically motivated distributed denial-of-service operations against Ukraine, NATO members, and other governments, public institutions, and private-sector organizations perceived as supporting Ukraine or opposing Russian interests. The group is widely tracked under aliases including NoName057, NoName05716, nnm05716, Nnm05716, and 05716nnm. The actor emerged shortly after Russia’s full-scale invasion of Ukraine, initially targeting Ukrainian media and later expanding across Europe and other NATO-aligned states. Reported victim sectors have included government and public administration, transportation and logistics, banking and financial services, telecommunications, defense-related organizations, media, and energy. Campaigns frequently align with geopolitical flashpoints such as military aid announcements, diplomatic visits, elections, NATO events, and other symbolic moments, indicating a strong propaganda and coercive component in target selection. NoName057(16)’s core tradecraft centers on disruptive DDoS activity rather than stealthy intrusion or long-term espionage. The group publicly claims attacks through Telegram and uses those channels for recruitment, messaging, and amplification of pro-Russian and anti-Western narratives. A defining feature of its operations is the DDoSia ecosystem, a volunteer-driven attack platform that distributes targets and attack parameters to participants and incentivizes contribution with cryptocurrency rewards. Reporting has also linked the group to earlier use of Bobik malware to support involuntary participation in DDoS operations, though its better-known model relies on mobilizing sympathizers and low-skill participants at scale. Technical reporting describes DDoSia as a multi-platform tool that evolved over time and supports common Layer 7 and Layer 4 flooding methods. The group’s infrastructure has used rotating command-and-control tiers and rapid server turnover to sustain operations and complicate disruption. Operational tempo has been high, with thousands of claimed or observed attacks since 2022 and sustained targeting of thousands of hosts across Europe, especially government and public-sector entities. NoName057(16) is generally assessed as less sophisticated than state espionage or sabotage units, but it remains operationally relevant because it can generate repeated service disruption, media attention, and psychological impact at low cost. Multiple assessments characterize the group as closely aligned with Kremlin interests, and some reporting has described it as a Kremlin-linked covert project using Telegram and the DDoSia toolchain. At the same time, public reporting does not uniformly establish formal command-and-control by the Russian state. The actor is best understood as part of the broader pro-Russian hacktivist ecosystem that overlaps with influence operations and, at times, with other Russia-aligned groups such as Cyber Army of Russia Reborn, Killnet affiliates, and Z-Pentest. Law-enforcement action has targeted the group’s infrastructure and participants, including a multinational disruption effort known as Operation Eastwood that reportedly affected more than 100 servers and generated arrests, warrants, and participant notifications. Despite these actions, NoName057(16) has continued to claim attacks and remains one of the most active pro-Russian DDoS-focused hacktivist actors targeting Western and NATO-aligned organizations.