Loading story…
Pro-Russian hacktivist group NoName057(16) intensified distributed denial-of-service attacks against government and private-sector targets across Europe, including Dutch public services disrupted around the NATO Summit in The Hague. Reported incidents in the Netherlands included attacks on municipal and provincial websites and an earlier strike on Logius that temporarily affected DigiD and access to services used by the Belastingdienst, UWV, DUO, and hospital portals. The group has also targeted organizations in Ukraine, Israel, and other European countries, often timing attacks to politically significant events and focusing on sectors such as government, transportation, banking, defense, media, and energy.
The group’s operations relied on Telegram for propaganda, recruitment, and coordination, while the DDoSia platform distributed encrypted attack parameters to volunteers who could be rewarded with cryptocurrency. Reporting also linked the ecosystem to malware including Bobik and RedLine Stealer, which were used to support involuntary participation in attacks. An international law-enforcement action, Operation Eastwood, led by Europol and Eurojust, disrupted more than 100 servers tied to the network and resulted in arrests, warrants, and notifications to participants, dealing a significant blow to the group’s infrastructure even as its public claims were described as overstating real-world impact.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
An international law-enforcement action led by Europol and Eurojust targeted NoName057 and resulted in arrests, warrants, participant notifications, and the disruption of more than 100 servers linked to the group. The operation represented a major coordinated takedown effort against the network.
After initially targeting Ukrainian media, NoName057 broadened its targeting to government, transportation, banking, defense, media, and energy organizations across Europe, Israel, and Ukraine. The group especially timed attacks around politically significant events.
An earlier DDoS attack on Logius temporarily disrupted DigiD and access to services from the Belastingdienst, UWV, DUO, and hospital portals in the Netherlands. The incident is highlighted as part of NoName057(16)'s activity affecting Dutch institutions.
The group intensified politically motivated DDoS operations against Dutch public institutions and private organizations, including municipal and provincial websites, around the NATO Summit 2025 in The Hague. The activity marked a notable extension of its campaign into the Netherlands.
The group emerged in March 2022 and began operating as a pro-Russian hacktivist collective focused primarily on distributed denial-of-service attacks. Its activity was tied to Telegram-based recruitment and the DDOSIA ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
mrtiepolo.medium.com
Open sourcehuntandhackett.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Pro-Russian hacktivist group NoName057(16) conducted a large-scale distributed denial-of-service (DDoS) campaign between December 8 and 14, 2025, primarily targeting organizations in Belgium and Ukraine. The campaign, orchestrated using the group's proprietary DDoSia tool, resulted in over 4,400 recorded attacks against 155 unique domains and 144 IP addresses, affecting both private sector infrastructure—such as telecommunications, utilities, and industrial organizations—and high-value government and defense-related services. The attacks also impacted European Union institutions and international organizations, highlighting the group's broad targeting scope and operational reach. NoName057(16) is a pro-Russian hacktivist collective with origins linked to the Kremlin-backed Centre for the Study and Network Monitoring of the Youth Environment (CISM). The group leverages Telegram for coordination and GitHub for tool distribution, and has expanded its influence through collaborations with other pro-Russian groups, including the Cyber Army of Russia Reborn (CARR). Their operations have increasingly focused on NATO member states and adversaries of Russian geopolitical interests, with the DDoSia tool serving as a central component in mobilizing and executing attacks against critical infrastructure and government entities across Europe.
Jun 29, 2026
SOCRadar reported a coordinated, multi-country **DDoS campaign** attributed to pro-Russian actor **NoName057(16)** using the **DDoSia** tool, with **5,830** recorded attack entries against **160 domains** and **181 IPs** during the Jan 26–Feb 1, 2026 analysis window. The activity showed broad geographic targeting, led by the **UK (55%)**, followed by **Ukraine (12.7%)** and **Czechia (4.9%)**, and focused heavily on public-sector and critical-service targets; the report also noted frequent target-list updates distributed via Telegram and that **port 443** was the most targeted. Separately, Polish authorities (CBCZ) arrested and then bailed a **20-year-old** suspected of running a multi-layered botnet used to DDoS “numerous popular websites,” including sites described as strategically important, using “C2 stresser” and command-and-control nodes; police seized equipment and claimed to have dismantled infrastructure used to host/distribute DDoS tools, with additional arrests possible. An NSFOCUS monthly report on **December 2025 APT activity** (e.g., TransparentTribe, Sidewinder, Konni, Gamaredon) describes broader spear-phishing-led intrusion trends and is not tied to the NoName057(16) DDoSia activity or the Polish DDoS case.
Jun 29, 2026
Pro-Russian hacktivist group NoName057(16) claimed responsibility for distributed denial-of-service (DDoS) attacks that briefly disrupted the websites of Belgian telecom operators Proximus and Scarlet. The attacks, which occurred on a Wednesday morning, were detected and mitigated quickly by Proximus technicians, resulting in minimal impact. NoName057(16) also claimed to have targeted an internal Telenet portal, but Telenet denied any disruption or compromise. Ghent University Hospital was also affected by a DDoS attack around the same time, though there is no confirmation of a direct link to the telecom incidents. The attacks are part of a broader campaign announced by a coalition of eight hacktivist groups with pro-Russian and pro-Palestinian affiliations, which have threatened to target Belgium’s internet infrastructure with DDoS operations and potential data exposure. While the coalition itself has not issued operational claims or demonstrated verifiable activity, NoName057(16) continues to act independently, maintaining a pattern of targeting Belgian entities. The campaign is expected to persist, with further DDoS attempts and possible claims of data exposure anticipated in the near future.
Jun 29, 2026