Coordinated DDoS activity targeting government infrastructure in Europe and Russia

A sustained DDoS campaign attributed to NoName057(16) used the DDoSia tool to generate 6,649 recorded attack entries between Feb. 23 and Mar. 1, targeting 126 domains and 135 IPs with a multi-country focus on Denmark, Greenland, and Ukraine. Reported targeting emphasized public-sector services (about 44% of attacks), alongside Ukrainian defense industry, tourism/travel (notably tied to Greenland’s economy), and transportation infrastructure; most traffic was directed at 443/tcp (HTTPS). The activity aligns with politically motivated disruption tied to Denmark’s support for Ukraine and heightened Arctic sovereignty tensions involving Greenland.

Separately, Russia’s internet regulator Roskomnadzor and the Russian Defense Ministry reported a “complex multi-vector” DDoS that briefly disrupted multiple government websites and related infrastructure, including systems of the Main Radio Frequency Center (GRFC). Russian authorities said the attack was contained, but user reports indicated intermittent access issues persisted for days; the responsible actor was not identified and no public claim of responsibility was noted at the time of reporting. A ransomware “state of the month” roundup covering February incidents is not directly related to these DDoS events and should be treated as separate reporting.