Loading story…
The UK’s National Cyber Security Centre (NCSC) issued a renewed warning that Russian-aligned hacktivist groups continue to target UK local authorities and critical national infrastructure (CNI) with disruptive denial-of-service (DoS/DDoS) activity intended to take public-facing websites and online services offline. The alert emphasizes that while these attacks are often technically simple, they can still create significant operational disruption and recovery costs, and the NCSC urged organizations—especially those providing essential services—to review and implement its publicly available DoS resilience guidance.
The NCSC highlighted the ongoing activity of NoName057(16), an ideologically motivated pro-Russian actor associated with the DDoSia crowdsourced DDoS platform, noting that prior international law-enforcement disruption (including server takedowns and arrests under Operation Eastwood) did not eliminate the threat and the group has resumed operations. The warning also aligns with broader international advisories that have named additional pro-Russian hacktivist groups (including Cyber Army of Russia Reborn (CARR), Z-Pentest, and Sector16) as part of the wider DoS threat to Western organizations and critical services.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
By 2026-01-21, reporting on the NCSC warning noted that the U.K. government had announced a Government Cyber Action Plan to improve the security and resilience of online public services. The plan was backed by £210 million in funding.
Alongside its January 2026 warning, the NCSC urged organizations to improve resilience through upstream DDoS protections, scalable infrastructure, tested response plans, monitoring, and review of OT and remote-access exposures. The guidance emphasized that pro-Russian hacktivists are increasingly targeting systems underpinning critical services and may affect operational technology environments.
On 2026-01-19, the U.K. National Cyber Security Centre warned that Russian-aligned hacktivists continued to target U.K. local authorities, critical national infrastructure, and other organizations with disruptive DoS and DDoS attacks. The agency highlighted NoName057(16) as a persistent threat and said even low-sophistication attacks can cause significant operational and financial disruption.
In December 2025, the U.K. co-signed an international advisory warning that pro-Russian hacktivist groups were conducting cyber operations worldwide against government, private-sector, and critical infrastructure organizations. The advisory named groups including Cyber Army of Russia Reborn, Z-Pentest, Sector16, and NoName057(16).
An international law enforcement action known as Operation Eastwood disrupted NoName057(16) in July 2025. Despite the disruption, the group later resumed activity because key operators were believed to remain in Russia and outside investigators' reach.
The pro-Russian hacktivist group NoName057(16) became active in March 2022, launching ideologically motivated DDoS campaigns against organizations in NATO countries and other states viewed as hostile to Russia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcetherecord.media
Open sourcetechrepublic.com
Open sourcesecurityonline.info
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international law enforcement operation disrupted **NoName057(16)**, a pro-Russian hacktivist network accused of launching distributed denial-of-service attacks against Ukraine and countries supporting Kyiv, including EU and NATO members. Europol and Eurojust said **Operation Eastwood** took more than 100 servers offline, dismantled a significant portion of the group’s infrastructure, and led to arrests, arrest warrants, house searches, and interviews across multiple countries with U.S. support. Investigators said the group relied on automated tooling, botnet infrastructure, and the **DDoSia** platform, while recruiting participants through social media, messaging channels, cryptocurrency payments, and gamified incentives such as leaderboards and badges. U.S. authorities later tied the disruption to broader action against Russian state-backed cyber actors, unsealing indictments against **Victoria Eduardovna Dubranova** for allegedly supporting both **NoName057(16)** and **CyberArmyofRussia_Reborn (CARR)**. The Justice Department said the groups carried out hundreds of attacks worldwide, including activity targeting U.S. critical infrastructure such as public water systems and election infrastructure, and described NoName as a state-sanctioned project linked to Russian organization **CISM**. A related CISA advisory warned that pro-Russia hacktivists were conducting attacks against critical infrastructure, reinforcing concerns that ideologically branded DDoS campaigns are being used to advance Russian geopolitical objectives.
Aug 14, 2026
Researchers detailed two active Russia-linked threat operations using different intrusion models to target Western organizations. **TA577**, a phishing group active since 2020, was observed sending HTML attachments that force outbound SMB connections to `file://` URLs in order to capture **NTLMv2** authentication handshakes and steal credential hashes. Infrastructure hunting tied the campaign to a narrowed set of likely servers identified through Impacket-like 8-character SMB target names, a distinctive SMB server GUID, shared SSH banner hashes, and recurring hosting patterns across providers including **GLOBALWAYS**; some hosts also exposed a **"We’ll back soon.."** page, login panels, or default Apache pages. A separate analysis examined **NoName057(16)**, a pro-Russian hacktivist collective that has sustained disruptive attacks against Western targets, especially Italian banks, government entities, military infrastructure, and public administrations. The group operates a volunteer-driven DDoS ecosystem known as **DDosia** or **People Go Stresser 2.0**, combining attack tools, support channels, operational guidance, and cryptocurrency rewards to coordinate participants. Its operations primarily use Layer 7 HTTP floods and Layer 4 TCP-SYN attacks, with most traffic aimed at **TLS/443** services but also hitting SSH, FTP, and secure email ports; researchers also noted prior links between the collective and **Bobik RAT** infections used to support DDoS activity.
Jul 12, 2026
**NoName057(16)** has been identified as a pro-Russian hacktivist group conducting distributed denial-of-service (**DDoS**) attacks against websites tied to governments, news agencies, military organizations, suppliers, telecommunications providers, transportation authorities, and financial institutions. The group’s operations have focused on Ukraine and countries supporting Ukraine, with reported targeting that includes **Estonia, Lithuania, Norway, and Poland**. Reporting links the group to the **Dosia/DDoSia** malware family and describes an operation that has evolved through publicly documented infrastructure, targeting patterns, and campaign activity. The activity reflects a sustained disruptive effort aimed at public- and private-sector online services in European states aligned with Ukraine, reinforcing the group’s role as a persistent politically motivated DDoS threat.
Aug 14, 2026