NoName057(16)
Also known as: NoName05716
NoName057(16) emerged days after Russia's full-scale invasion of Ukraine and runs DDoS attacks through a volunteer model: it recruits participants on Telegram, gives them its DDoSia tool and target lists, and pays contributors in cryptocurrency. Its attacks are disruptive rather than destructive, mostly knocking websites offline for a time.
- Public attribution
- Described by Europol as a pro-Russian cybercrime network; Recorded Future reports activity patterns consistent with operators in a Russian time zone.
- Active since
- Around 2022
- Targets
- Government and public-sector websites in European countries that oppose Russia's invasion of Ukraine
Status: Reported disrupted by Operation Eastwood in July 2025 (Europol); not necessarily ended.
Notable campaigns
2022 onwardDDoSia campaigns
Sustained DDoS against European government and public-sector sites, averaging about 50 targets a day (Recorded Future).
2025Operation Eastwood
In July 2025 a Europol- and Eurojust-coordinated operation disrupted over 100 of the network's systems, with arrests and arrest warrants (reported).
Signature ATT&CK techniques
- T1498Network Denial of Service
- T1498.001Network Denial of Service: Direct Network Flood
- T1499.002Endpoint Denial of Service: Service Exhaustion Flood
- T1499.003Endpoint Denial of Service: Application Exhaustion Flood
Mapped to ATT&CK from the behaviour described in the cited sources; MITRE has no group entry for this actor.
Defences that work against this actor
- Use a DDoS protection or CDN service in front of public websites, with layer 7 rules and rate limiting.
- Cache static content so floods hit the edge, not the origin.
- Track geopolitical events: attacks spike around votes, aid announcements and summits.
- Prepare public messaging; the goal is often publicity, so a calm, quick recovery reduces impact.