hacktivist-operationbotnet-infrastructurecommand-and-control-methodoperational-disruption

NoName057(16) DDoSia Campaign and Separate Polish Botnet Arrest

Threat Actor Intelligence · 2 sources · Updated 4mo ago · First seen Feb 3, 2026

SOCRadar reported a coordinated, multi-country DDoS campaign attributed to pro-Russian actor NoName057(16) using the DDoSia tool, with 5,830 recorded attack entries against 160 domains and 181 IPs during the Jan 26–Feb 1, 2026 analysis window. The activity showed broad geographic targeting, led by the UK (55%), followed by Ukraine (12.7%) and Czechia (4.9%), and focused heavily on public-sector and critical-service targets; the report also noted frequent target-list updates distributed via Telegram and that port 443 was the most targeted.

Separately, Polish authorities (CBCZ) arrested and then bailed a 20-year-old suspected of running a multi-layered botnet used to DDoS “numerous popular websites,” including sites described as strategically important, using “C2 stresser” and command-and-control nodes; police seized equipment and claimed to have dismantled infrastructure used to host/distribute DDoS tools, with additional arrests possible. An NSFOCUS monthly report on December 2025 APT activity (e.g., TransparentTribe, Sidewinder, Konni, Gamaredon) describes broader spear-phishing-led intrusion trends and is not tied to the NoName057(16) DDoSia activity or the Polish DDoS case.

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jan 26, 2026 – Feb 3, 2026

Feb 3, 20269mo ago
Suspect is charged, admits most allegations, and is released on bail
After questioning, Polish authorities brought six charges related to disrupting IT systems and obtaining software used for attacks, carrying a maximum penalty of five years in prison. The suspect reportedly admitted most of the allegations, gave a statement, and was released on bail under non-custodial police supervision pending sentencing.
Feb 3, 20269mo ago
Polish police arrest suspected botnet-based DDoS operator
Poland's Central Bureau for Combating Cybercrime arrested a 20-year-old man suspected of launching DDoS attacks against numerous websites, including strategically important sites, using a multi-layered botnet. Officers searched his apartment, seized computer equipment, and said they dismantled infrastructure used to host and distribute DDoS tools.
Jan 26, 20269mo ago
NoName057(16) runs multi-country DDoS campaign
Between 2026-01-26 and 2026-02-01, the pro-Russian hacktivist group NoName057(16) conducted a coordinated DDoS campaign using DDoSia against targets in multiple countries. SOCRadar recorded 5,830 attack entries affecting 160 domains and 181 IP addresses, with the UK as the primary target and additional attacks on Ukraine, Czechia, and commercial or critical-infrastructure organizations.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Threat actors

1 linked

NoName057(16)

Malware

1 linked

DDoSia

Organizations

5 linked

Confederation of British IndustryRail.co.ukScottish WaterEnergy BrokersICOSA Water Services

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Socradar BlogNews · Feb 3, 2026

Multi-Country DDoS Campaign: Weekly DDoS Threat Intelligence AnalysisOpen source ↗

Polish cops bail 20-year-old bedroom botnet operator • The RegisterOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News