Loading threat actor…
NoName057(16), also known as NoName057, NoName05716 and nnm05716, is a Russia-linked, pro-Russian hacktivist network active since March 2022. Its principal activity is politically motivated distributed denial-of-service (DDoS) attacks against Ukraine and countries supporting Ukraine. It targets government and diplomatic services, transportation infrastructure, banks, telecommunications providers, healthcare organizations and defense-related entities. Campaigns frequently coincide with diplomatic events, statements criticizing Russia or other geopolitical developments. The group uses Telegram to announce targets, recruit participants, coordinate activity and amplify attack claims. Its associated DDoSia Project, also called DDosia, is a crowdsourced DDoS operation that enables volunteers to contribute attack traffic, with cryptocurrency rewards available to some participants. NoName057(16) has also used the Bobik botnet. Its attacks primarily seek to impair online-service availability and generate political pressure and publicity; website disruption does not itself establish intrusion, data theft or disruption of underlying operational systems. Prominent campaigns have targeted Italian ministries, airports, ports and banks, as well as French public institutions, transport organizations and telecommunications services through the prolonged #OpFrance campaign. The group has also compromised exposed IP cameras at Estonian and Canadian organizations. It has collaborated with other pro-Russian hacking groups, including Zarya, and joined forces with AzzaSec. In July 2025, Operation Eastwood, coordinated by Europol and Eurojust, disrupted more than 100 servers used by the network and took much of its central infrastructure offline. The group subsequently continued announcing attacks. Its established motivation is pro-Russian ideological hacktivism; direct Russian government control has not been established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
32 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
95 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A pro-Russian ideological collective claiming DDoS attacks against La Poste Mobile's website, customer portal, SIM activation service and other subdomains on October 21, 2026, within the broader #OpFrance campaign. The claims were not independently attributed or publicly confirmed by the operator at the time of reporting. The article also describes claimed attacks against French ports, shipping companies, government and defense organizations, and a previously confirmed DDoS incident affecting La Poste and La Banque Postale in December 2025. No evidence establishes data theft, intrusion into La Poste Mobile's systems or disruption of its mobile network. Despite the July 2025 Operation Eastwood infrastructure disruption, the group continues claiming attacks.
Conducts a recurring campaign against French organizations, claiming DDoS attacks on government, defense-industrial, energy and financial targets. It also claims unauthorized manipulation of a small French hydroelectric plant through an industrial HMI, but that claim is unverified. The group has neither claimed nor been linked to the supermarket refrigeration attack and is discussed as contextual background.
A pro-Russian hacktivist group cited as having previously conducted DDoS attacks against Italian institutions. It is mentioned as historical background; the content does not attribute the current attack on Italy's Ministry of Foreign Affairs to this group.
A pro-Russian hacktivist group conducting politically timed DDoS campaigns against governments supporting Ukraine. The article describes repeated targeting of Italian government websites, banks, ports and airports. Its linked DDoSia operation listed Italian ministries and diplomatic websites as planned targets on October 8, 2026. However, the Foreign Ministry did not attribute the current attack, and the target list does not establish responsibility or successful disruption.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.