Loading malware…
DDoSia is a cross-platform distributed denial-of-service toolkit and volunteer-driven attack platform operated by the pro-Russian hacktivist group NoName057(16). Launched in 2022, it enables participants to contribute computing resources and bandwidth to coordinated attacks against operator-selected targets. Unlike a conventional botnet built primarily from compromised devices, DDoSia relies heavily on supporters who voluntarily install and run its client. Recruitment, software distribution, registration, operational messaging, and contributor leaderboards are coordinated through Telegram; the toolkit has also been distributed through GitHub. Participants can receive cryptocurrency rewards based on their contributions.
Early clients were implemented in Python, while subsequent versions use Go and support Windows, Linux, and macOS on multiple processor architectures. Clients authenticate using participant-specific identifiers, retrieve centrally assigned target lists and attack parameters, generate attack traffic, and report operational statistics. Later versions encrypt target configurations, which are decrypted in process memory before attack execution. Supported techniques include HTTP GET and POST floods, HTTP/2 floods, TCP SYN floods, and slowloris-style connection exhaustion, covering both application-layer and transport-layer denial of service.
DDoSia campaigns primarily target Ukraine and European countries supporting Ukraine, including NATO members. Targets span government and diplomatic services, financial institutions, transportation and logistics, telecommunications, media, defense, and energy organizations. Operations frequently coincide with geopolitical developments and politically significant events, seeking service disruption and propaganda impact rather than demonstrating system intrusion or data theft.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
During the December 2025 holiday rush, the pro-Russian hacktivist group Noname057(16) used the DDoSia botnet to launch coordinated TCP SYN and HTTP GET request floods targeting the victim's web-facing portals and API endpoints.
“Noname057(16) developed a project—malicious software called Ddosia”
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Rather than operating a traditional botnet, the group leverages a volunteer-based system, mobilizing supporters - referred to as “heroes” - via Telegram. These individuals install the DDoSia client on their personal devices to participate in coordinated DDoS attacks. | To gain greater support for their activities and effectively mobilize their community, NoName strategically leverages DDoSia... These individuals install the DDoSia client on their personal devices to participate in coordinated DDoS attacks.
The current version of the DDosia bot is named “People Go Stresser 2.0”... Like the previous python version, even this bot version supports both L7 and L4 attack techniques.
Since 2024, DDOSIA communicates with a central C2 server using AES-GCM encryption, providing confidentiality and integrity.
DDOSIA also sends the C2 some details about the host it’s running on, including a GUID that uniquely identifies the user’s machine.
The DDoS tool (DDOSIA) receives targeting information from the /client/get_targets URL path on either of these domains (over HTTP on TCP/80).
http | L7 | Classical HTTP GET/POST request generation, but with advanced customization and request randomization support... http2 | L7 | Similar to the HTTP module but utilizes the modern HTTP/2 protocol for enhanced capabilities.
investigation into Stark Industries reveals it is being used as a global proxy network that conceals the true source of cyberattacks and disinformation campaigns against enemies of Russia
"target list updates distributed multiple times per day through Telegram channels"; "Centralized target lists updated multiple times daily via Telegram distribution"
Two Dynamic DNS (DDNS) domains, registered with No-IP, currently resolve to 31.13.195.87 : tom56gaz6poh13f28[.]myftp.org zig35m48zur14nel40[.]myftp.org
The C2 services are primarily hosted through Neterra... while also making use of No-IP Dynamic DNS services.
The content identifies distributed denial-of-service (DDoS) attacks and describes NoName057's "DDoSia Project," in which participants overload websites of government institutions, banks, and infrastructure.
NoName recruited volunteers from around the world to download DDoSia and used their computers to launch DDoS attacks on the victims that NoName leaders selected.
DDoS attacks at this layer are often designed to overwhelm application logic rather than saturate network bandwidth, as they can more easily bypass traditional firewalls because the requests look like normal user behavior.
tcp | L4 | Classic TCP-SYN flooding. Bots forge TCP segments with the SYN flag set and spoof source addresses with randomized source ports to overwhelm the target.
"Most common methods this week: GET: 2,375 ... POST: 1,172" / "Top port: 443 (HTTPS)"
The tool facilitates application-layer DDoS attacks by inundating target websites with a high volume of junk requests.
"Attack Types Distribution: GET Flood ... POST Flood ... The elevated POST flood share ... reflects the high proportion of form-based targets..."
51 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
51 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.