NoName057(16)Threat actor
- 05716nnm
- nnm05716
- NoName057
- noname05716
NoName057(16) is performing DDoS attacks on websites belonging to governments, news agencies, armies, suppliers, telecommunications companies, transportation authorities, financial institutions, and more in Ukraine and neighboring countries supporting Ukraine, like Ukraine itself, Estonia, Lithuania, Norway, and Poland.From MISP Galaxy
Last reported 4 days ago, by SOCRadar13 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1684Social Engineering
“…l manufacturing and distribution company stated that corporate information was leaked after employee devices were compromised by a social engineering attack.”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1195Supply Chain Compromise
“Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”
- T1218.002Control Panel
“Sekoia uncovered a new Russian-language cluster and a control panel showing more than 26 million site visits, confirming the campaign stays active.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
13 reports, newest first · the exact sentence from each-
Japan Data Breaches 2026: Inside the October Surge“In February, SOCRadar tracked a NoName057(16) DDoSia campaign in which Japan accounted for 39.4% of all attack entries (2,144), the group’s first sustained campaign against an Asian G7 country.”
-
French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply“Hacktivist pressure: Pro-Russian hacktivist group NoName057(16) continues its long-running #OpFrance DDoS campaign this week and claims to have manipulated a small French hydroelectric plant; nothing links it to the supermarket attack”
-
Italy’s Foreign Ministry Under Cyberattack as Embassy Sites Come Under Review“NoName057(16) is a pro-Russian group that declared itself in March 2022 and announces its targets on Telegram.”
-
Cyber Brief 26-02 - January 2026“The pro-Russia group NoName057(16) had previously claimed responsibility for a similar December DDoS attack.”
-
Network Segmentation Failures Are Expanding the Corporate Attack Surface““We tracked over 300 instances this year, including these examples carried out by the pro-Russian group, NoName057(16), in late August and early September against Estonian and Canadian targets.””
-
August 2026 Dark Web Threat Actor Trend Report“NoName057(16), BD Anonymous, and Dark Storm Team claimed responsibility for repeated DDoS attacks targeting websites of Japanese government agencies, local governments, and organizations in the transportation, finance, and shipbuilding sectors.”
-
Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal“NoName057(16) goes after Japan: Days after Japanese officials have criticized the Kremlin, its toady faketivist group NoName057(16) has announced plans to target Japanese web infrastructure with DDoS attacks.”
-
The Evolution of Hacktivism in Hybrid Warfare: Modern Tactics and Real-World Impact“These pro-Russian hacktivist groups, such as NoName057 and Killnet, alongside pro-Iranian collectives and proxy ecosystems like Handala Hack, often react to the news cycle and target countries designated by state media or ideological narratives as enemies.”
-
Ransom & Dark Web Issues Week 4, August 2026“NoName057(16) and BD Anonymous Claim DDoS Attacks Against Major Japanese Organizations and Companies [1] [2] [3] [4]”
-
Risky Bulletin: Russia starts blocking DoH and DoT“NoName057 leaks data on Spanish police and military: A pro-Kremlin hacktivist group has leaked the names of nearly 1,000 members of the Spanish military and police forces.”
-
The Bear Necessities: A Look at the Drivers, Dynamics, and Applications of the Pro-Russia Influence Ecosystem“The self-proclaimed hacktivist group NoName057(16) emerged following the Russian invasion of Ukraine in 2022, primarily targeting Ukraine and its partners and allies with DDoS attacks and various network intrusions.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“NoName057(16) Telegram post”
-
DoppelGänger: inside the pro-Russian influence campaign“…d with Ukraine has already been observed in activities related with pro-Russian groups conducting offensive cyber operations, such as NoName057(16).”
Indicators in its reports
named in the reports above- check-host[.]netin 1 report
- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
- ledialogue[.]frin 1 report
- levinaigre[.]netin 1 report
- derbayerischelowe[.]infoin 1 report
- mypride[.]pressin 1 report
- spicyconspiracy[.]infoin 1 report
- acrosstheline[.]pressin 1 report
- antiwar[.]comin 1 report
- electionwatch[.]livein 1 report
- theliberal[.]inin 1 report
- lesifflet[.]netin 1 report
- la-sante[.]infoin 1 report
- artichoc[.]ioin 1 report
- hxxp://a8czwp.gituyahmainnya18[.]click/s8yrcyin 1 report
- a8czwp.gituyahmainnya18[.]clickin 1 report
- hxxp://docnanb[.]com/holy9180238in 1 report
- docnanb[.]comin 1 report
- hxxp://arizztar[.]com/welt2337550in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.